Edit tour

Windows Analysis Report
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Overview

General Information

Sample name:	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
Analysis ID:	1461053
MD5:	68b15abf143f5df8aad10eab1d2513d5
SHA1:	cb2566d06a85191582ab524d68f38d85556fb880
SHA256:	c1aaa8b374f0c43ae3d8817ac7731f1f71d2d04089e9c51510cddf38097dfb54
Tags:	exe
Infos:

Detection

PureLog Stealer

Score:	57
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe (PID: 5856 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe" MD5: 68B15ABF143F5DF8AAD10EAB1D2513D5)

setup.exe (PID: 6136 cmdline: C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672 MD5: B005E4007EB93F23BB0E7F03FB634D46)

setup.exe (PID: 4788 cmdline: "C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=704 -burn.filehandle.self=712 AID=18672 MD5: 29467FD9BE93C4AC0BA9D863AE30EDF9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3927775163.00000000077E2000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.3927026125.00000000075A2000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
4.2.setup.exe.75a0000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.setup.exe.71a0000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.setup.exe.76e0000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
4.2.setup.exe.77e0000.8.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.setup.exe.77e0000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Snort Signatures

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 156.146.33.140

Timestamp:	06/22/24-06:27:57.276819
SID:	2020826
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://static.adtidy.net/windows/installer.exe.	Avira URL Cloud: Label: malware
Source: http://static.adtidy.net/windows/installer.exe	Avira URL Cloud: Label: malware
Source: https://static.adtidy.net/windows/installer.exe	Avira URL Cloud: Label: malware

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_00699F8F DecryptFileW,	3_2_00699F8F
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006BF340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	3_2_006BF340
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_00699D74 DecryptFileW,DecryptFileW,	3_2_00699D74
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00289F8F DecryptFileW,	4_2_00289F8F
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002AF340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	4_2_002AF340
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00289D74 DecryptFileW,DecryptFileW,	4_2_00289D74

Compliance

Uses 32bit PE files

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 156.146.33.138:443 -> 192.168.2.5:49718 version: TLS 1.0

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 212.102.56.179:443 -> 192.168.2.5:49709 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: AdGuard.Utils.Base.pdb source: setup.exe, setup.exe, 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: AdGuard.Utils.pdb source: setup.exe, setup.exe, 00000004.00000002.3927775163.00000000077E2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.4.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb source: System.Data.SQLite.dll.4.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb,[ source: System.Data.SQLite.dll.4.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR11-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb source: setup.exe, setup.exe, 00000004.00000002.3924968992.0000000006F8C000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdb source: setup.exe, setup.exe, 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdb source: setup.exe, setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: AdGuard.Utils.UI.pdb source: setup.exe, setup.exe, 00000004.00000002.3927026125.00000000075A2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: setup.exe, 00000004.00000002.3929487548.0000000008002000.00000002.00000001.01000000.00000016.sdmp, Newtonsoft.Json.dll.4.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdbH source: setup.exe, 00000004.00000002.3923329796.00000000049F2000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.4.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: setup.exe, 00000004.00000002.3938133528.000000006CD04000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdb source: setup.exe, setup.exe, 00000004.00000002.3923329796.00000000049F2000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.4.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: setup.exe, 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000003.00000000.2341636279.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.3918348366.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000004.00000000.2346193381.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: setup.exe, setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr
Source:	Binary string: AdGuard.CrashReporter.pdbxZ source: setup.exe, 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdbSHA256 source: setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp

Spreading

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B7437 FindFirstFileExW,	3_2_006B7437
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_00699A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	3_2_00699A1D
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006C3C72 FindFirstFileW,FindClose,	3_2_006C3C72
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A7437 FindFirstFileExW,	4_2_002A7437
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00289A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	4_2_00289A1D
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002B3C72 FindFirstFileW,FindClose,	4_2_002B3C72
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00273D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	4_2_00273D4E
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCFBF0F FindFirstFileExA,	4_2_6CCFBF0F

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49734 -> 156.146.33.140:80

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: AdGuardVpn.dll.4.dr

Static PE information: Found NDIS imports: FwpmSubLayerAdd0, FwpmGetAppIdFromFileName0, FwpmFilterAdd0, FwpmFreeMemory0, FwpmEngineOpen0, FwpmTransactionBegin0, FwpmProviderAdd0, FwpmTransactionAbort0, FwpmEngineClose0, FwpmTransactionCommit0

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.setup.exe.77e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 156.146.33.138 156.146.33.138

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 156.146.33.138:443 -> 192.168.2.5:49718 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_00018E34 GetLastError,InternetOpenW,InternetOpenUrlW,HttpQueryInfoA,InternetReadFile,WriteFile,RtlFreeHeap,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,GetLastError,CloseHandle,

0_2_00018E34

Source: global traffic	HTTP traffic detected: GET /windows/installer.exe HTTP/1.1User-Agent: AdGuard VPN Web InstallerHost: static.adtidy.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /windows/installer.exe HTTP/1.1User-Agent: AdGuard VPN Web InstallerHost: static.adtidy.net
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: static.adtidy.net
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: static.adguard.com

Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.adguard.com/FDefault
Source: setup.exe, 00000004.00000002.3924968992.0000000006F62000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://api.adguard.com/uninstall.html
Source: setup.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: setup.exe, 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000003.00000000.2341636279.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.3918348366.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000004.00000000.2346193381.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, BootstrapperCore.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: setup.exe, setup.exe, 00000004.00000002.3924968992.0000000006F8C000.00000002.00000001.01000000.0000000F.sdmp, setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0
Source: setup.exe, 00000004.00000002.3924968992.0000000006F8C000.00000002.00000001.01000000.0000000F.sdmp, setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0$
Source: setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: setup.exe, setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://sentry-dsn.invalid
Source: setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.com
Source: setup.exe, setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.com/installer.v1.0.json
Source: setup.exe, 00000004.00000002.3923329796.00000000049F2000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.4.dr	String found in binary or memory: http://static.adguard.com/installer.v1.0.json=args
Source: setup.exe, 00000003.00000002.3920265492.0000000003140000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2343102018.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3918974616.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2342942227.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3922246145.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2361338341.0000000001666000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3919679979.0000000001630000.00000004.00000020.00020000.00000000.sdmp, BootstrapperApplicationData.xml.4.dr	String found in binary or memory: http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: http://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2343930546.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exe(
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exe.
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exe29
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exeR
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exeW
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344266307.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exej
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: http://wixtoolset.org
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/
Source: setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: setup.exe, setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/releases/
Source: setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr	String found in binary or memory: http://wixtoolset.org/releases/SCreating
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/telemetry/v
Source: Newtonsoft.Json.dll.4.dr	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: setup.exe, 00000003.00000002.3920265492.0000000003140000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2343102018.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3918974616.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2342942227.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3922246145.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://adguard.com
Source: setup.exe, 00000004.00000002.3919679979.000000000168E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2361546962.000000000168E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2361338341.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adguard.comd
Source: setup.exe, 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dev.adguard.com&https://adguard.com
Source: setup.exe, 00000004.00000002.3923483607.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp, installer[1].htm.0.dr	String found in binary or memory: https://error.c.cdn77.org/
Source: setup.exe, 00000003.00000002.3920265492.0000000003140000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3918974616.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3922246145.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3919679979.0000000001630000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kb.adguard.com/
Source: setup.exe, setup.exe, 00000004.00000002.3924968992.0000000006F62000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://link.adtidy.info
Source: setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s10.adtidy.net:443/api/55/store/
Source: setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s10.adtidy.net:443/api/embed/error-page/
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: setup.exe, 00000004.00000002.3923483607.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adguard.com
Source: setup.exe, 00000004.00000002.3923483607.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adguard.com/installer.v1.0.json
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2343032241.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2343930546.0000000001292000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: https://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2343930546.000000000125E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344266307.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/windows/installer.exe&
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/windows/installer.exeM
Source: System.Data.SQLite.dll.4.dr	String found in binary or memory: https://system.data.sqlite.org/
Source: System.Data.SQLite.dll.4.dr	String found in binary or memory: https://system.data.sqlite.org/X
Source: setup.exe, 00000004.00000002.3924968992.0000000006F62000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://vpn.website.agrd.dev.https://adguard-vpn.com0https://link.adtidy.info
Source: BootstrapperCore.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: setup.exe, setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.getsentry.com
Source: setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.getsentry.com.
Source: Newtonsoft.Json.dll.4.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 212.102.56.179:443 -> 192.168.2.5:49709 version: TLS 1.2

System Summary

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00015010	0_2_00015010
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00013D60	0_2_00013D60
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AC01F	3_2_006AC01F
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B01A6	3_2_006B01A6
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006862CC	3_2_006862CC
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006BA28E	3_2_006BA28E
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B0461	3_2_006B0461
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B2413	3_2_006B2413
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B2642	3_2_006B2642
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006BE73C	3_2_006BE73C
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AF8C3	3_2_006AF8C3
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AFC35	3_2_006AFC35
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B9DE0	3_2_006B9DE0
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AFEDF	3_2_006AFEDF
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006A3F71	3_2_006A3F71
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029C01F	4_2_0029C01F
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A01A6	4_2_002A01A6
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002AA28E	4_2_002AA28E
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002762CC	4_2_002762CC
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A2413	4_2_002A2413
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A0461	4_2_002A0461
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A2642	4_2_002A2642
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002AE73C	4_2_002AE73C
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029F8C3	4_2_0029F8C3
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029FC35	4_2_0029FC35
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A9DE0	4_2_002A9DE0
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029FEDF	4_2_0029FEDF
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00293F71	4_2_00293F71
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_06F64198	4_2_06F64198
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768EA67	4_2_0768EA67
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07687043	4_2_07687043
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768C722	4_2_0768C722
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768E8E1	4_2_0768E8E1
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07685483	4_2_07685483
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768D083	4_2_0768D083
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCFD880	4_2_6CCFD880
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CD02918	4_2_6CD02918
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF7117	4_2_6CCF7117
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCFDD2E	4_2_6CCFDD2E
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF6EE8	4_2_6CCF6EE8
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_038DD7B8	4_2_038DD7B8
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_038D2C38	4_2_038D2C38
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_038D2C28	4_2_038D2C28
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0715C768	4_2_0715C768
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07150D90	4_2_07150D90
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07156A50	4_2_07156A50
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_071519E8	4_2_071519E8
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0715C758	4_2_0715C758
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07156A41	4_2_07156A41
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0715F18A	4_2_0715F18A
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0715F1C0	4_2_0715F1C0
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0715F1C0	4_2_0715F1C0
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_071519E0	4_2_071519E0
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_074EB200	4_2_074EB200
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_074ED220	4_2_074ED220
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_074E09D1	4_2_074E09D1
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_074E09E0	4_2_074E09E0
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07678140	4_2_07678140
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07683339	4_2_07683339
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_08009D27	4_2_08009D27

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll 5BC6335BC9649AF916A82965E3B55C1B693C216B4FA4D76740F2DB4616E82CD5

Found potential string decryption / allocating functions

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: String function: 002AFFF0 appears 34 times
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: String function: 002738BA appears 499 times
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: String function: 002AFB09 appears 679 times
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: String function: 00272022 appears 54 times
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: String function: 002B2B5D appears 81 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 006C2B5D appears 78 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00682022 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 006BFFF0 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 006838BA appears 497 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 006BFB09 appears 679 times

Uses 32bit PE files

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: AdGuardVpn.Burn.dll.4.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: AdGuard.Vpn.Common.dll.4.dr, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'
Source: AdGuard.Vpn.Common.dll.4.dr, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'
Source: AdGuard.Vpn.Common.dll.4.dr, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'
Source: AdGuard.Vpn.Common.dll.4.dr, A2H1lUZ15GsIooGy4G.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal57.troj.evad.winEXE@5/100@3/2

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_00682078 FormatMessageW,GetLastError,LocalFree,

3_2_00682078

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_00684639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		3_2_00684639
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00274639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		4_2_00274639

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006C28BD GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

3_2_006C28BD

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_00019998 GetModuleHandleW,FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_00019998

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006A68EE ChangeServiceConfigW,GetLastError,

3_2_006A68EE

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\installer[1].htm

Jump to behavior

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Mutant created: NULL
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\AdguardVpnInstaller_F23CB6CB-327E-4BB5-B9DF-7062501506B8
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\AdguardVpnBurn_UI_F23CB6CB-C5F8-47BA-B854-DB660C1500BB

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

File created: C:\Users\user\AppData\Local\Temp\adguard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: cabinet.dll	3_2_00681070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: msi.dll	3_2_00681070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: version.dll	3_2_00681070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: comres.dll	3_2_00681070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: msasn1.dll	3_2_00681070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: crypt32.dll	3_2_00681070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: feclient.dll	3_2_00681070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: cabinet.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: msi.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: version.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: wininet.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: comres.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: clbcatq.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: msasn1.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: crypt32.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: feclient.dll	4_2_00271070
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Command line argument: cabinet.dll	4_2_00271070

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [__preferences] ( [key] TEXT NOT NULL, [type] TEXT NOT NULL, [value] >, PRIMARY KEY ([key], [type]));x@{0}({1} {2} Autoincrement={3} NullValue={4} StartValue={5})\|Cannot build this statement for table without primary key for
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table' AND name='__preferences';LPreference table exists, doing nothingdThe database schema has been successfully verified

Source: setup.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: setup.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: setup.exe	String found in binary or memory: http://static.adguard.com/installer.v1.0.json
Source: setup.exe	String found in binary or memory: /reinstall
Source: setup.exe	String found in binary or memory: views/installsetting.baml
Source: setup.exe	String found in binary or memory: views/installprogress.baml
Source: setup.exe	String found in binary or memory: /AdGuardVpn.Burn;component/views/installprogress.xaml
Source: setup.exe	String found in binary or memory: /AdGuardVpn.Burn;component/views/installsetting.xaml
Source: setup.exe	String found in binary or memory: t in-addr.arpa in-the-band.net in.na in.net in.rs in.th in.ua in.us ina.ibaraki.jp ina.nagano.jp ina.saitama.jp inabe.mie.jp inagawa.hyogo.jp inagi.tokyo.jp inami.toyama.jp inami.wakayama.jp inashiki.ibaraki.jp inatsuki.fukuoka.jp inawashiro
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: https_url https://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: http_url http://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: A`~@https_url https://static.adtidy.net/windows/installer.exe

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe "C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Process created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Process created: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe "C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=704 -burn.filehandle.self=712 AID=18672
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Process created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Process created: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe "C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=704 -burn.filehandle.self=712 AID=18672	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: AdGuard.Utils.Base.pdb source: setup.exe, setup.exe, 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: AdGuard.Utils.pdb source: setup.exe, setup.exe, 00000004.00000002.3927775163.00000000077E2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.4.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb source: System.Data.SQLite.dll.4.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb,[ source: System.Data.SQLite.dll.4.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR11-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb source: setup.exe, setup.exe, 00000004.00000002.3924968992.0000000006F8C000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdb source: setup.exe, setup.exe, 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdb source: setup.exe, setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: AdGuard.Utils.UI.pdb source: setup.exe, setup.exe, 00000004.00000002.3927026125.00000000075A2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: setup.exe, 00000004.00000002.3929487548.0000000008002000.00000002.00000001.01000000.00000016.sdmp, Newtonsoft.Json.dll.4.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdbH source: setup.exe, 00000004.00000002.3923329796.00000000049F2000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.4.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: setup.exe, 00000004.00000002.3938133528.000000006CD04000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdb source: setup.exe, setup.exe, 00000004.00000002.3923329796.00000000049F2000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.4.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: setup.exe, 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000003.00000000.2341636279.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.3918348366.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000004.00000000.2346193381.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: setup.exe, setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr
Source:	Binary string: AdGuard.CrashReporter.pdbxZ source: setup.exe, 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdbSHA256 source: setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: AdGuard.Vpn.Common.dll.4.dr, A2H1lUZ15GsIooGy4G.cs

.Net Code: Type.GetTypeFromHandle(ON8eS9ftSsVqdPJQfI.PaB6mYsKuc(16777313)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(ON8eS9ftSsVqdPJQfI.PaB6mYsKuc(16777248)),Type.GetTypeFromHandle(ON8eS9ftSsVqdPJQfI.PaB6mYsKuc(16777260))})

Binary contains a suspicious time stamp

Source: AdGuardVpn.Burn.dll.4.dr

Static PE information: 0x8239DF2F [Sun Mar 27 09:26:07 2039 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_000114F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000114F0

PE file contains sections with non-standard names

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Static PE information: section name: .eh_fram
Source: installer[1].exe.0.dr	Static PE information: section name: .wixburn
Source: setup.exe.0.dr	Static PE information: section name: .wixburn
Source: setup.exe.3.dr	Static PE information: section name: .wixburn
Source: AdGuardVpn.dll.4.dr	Static PE information: section name: .detourc
Source: AdGuardVpn.dll.4.dr	Static PE information: section name: .detourd

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0001B55C push eax; mov dword ptr [esp], ebx	0_2_0001B597
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00018170 push ecx; mov dword ptr [esp], ebx	0_2_000188F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00018170 push eax; mov dword ptr [esp], ebx	0_2_00018947
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00019998 push edx; mov dword ptr [esp], eax	0_2_000199FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00018E34 push edx; mov dword ptr [esp], edi	0_2_000190EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0001B6A8 push ecx; mov dword ptr [esp], eax	0_2_0001BA6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0001B6A8 push ebx; mov dword ptr [esp], 00000005h	0_2_0001BE95
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0001B6A8 push edx; mov dword ptr [esp], eax	0_2_0001BF78
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0001F8E2 push ecx; ret	0_2_0001F8E3
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AE806 push ecx; ret	3_2_006AE819
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029E806 push ecx; ret	4_2_0029E819
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_049F498D push es; retf	4_2_049F49B2
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_049F3AEF push es; retf 0000h	4_2_049F3B0A
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_049F3BCF push es; iretd	4_2_049F3BEA
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_075A73F3 push es; iretd	4_2_075A73FB
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_075A6907 push ss; retf	4_2_075A6914
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768E14D push es; retf	4_2_0768E164
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768EA5F push ss; retf	4_2_0768EA64
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768E625 push cs; retf	4_2_0768E626
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768E5ED push cs; retf	4_2_0768E5F0
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0768DFA9 push es; retf	4_2_0768E164
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_076E7A54 pushfd ; ret	4_2_076E7A55
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_077E3A5D push es; ret	4_2_077E3A63
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF4476 push ecx; ret	4_2_6CCF4489
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_038D6CE8 push edx; ret	4_2_038D6CEB
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07155632 push edx; iretd	4_2_07155633
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0715FD44 push dword ptr [ebp+34h]; mov dword ptr [esp], eax	4_2_0715FD48
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_07158BD5 pushfd ; iretd	4_2_07158BD6

Source: AdGuard.Vpn.Common.dll.4.dr, A2H1lUZ15GsIooGy4G.cs	High entropy of concatenated method names: 'GspsMKXkPKxA9VBkSPa', 'qutxYqXHALN68uONKpT', 'ce4DmfsmSrOT856tDgfrkMb', 'LtQPyoxJn7', 'l5f6JtXuSAI0UaewkDR', 'ymtvmHXf867G4Qo1X74', 'YW1RCqXzP5Ndmw0d5bL', 'KCBwKaMhaMJ1oXv9coJ', 'Pmik3wMe4of7NyZYt5f', 'lxTSvsMxJn6MbgmBsGc'
Source: AdGuard.Vpn.Common.dll.4.dr, rWY84bHprLZQaKBPR2.cs	High entropy of concatenated method names: 'uVjJtZjRiO', 'RxjJoVoNMY', 'dZdL4TA5nA', 'u85L84AVhb', 'pSILrhU6aH', 'qsBLuaqJWy', 'Ti7JhxPskd', 'MpHxPh7vl6', 'V09LzssmKT', 'HjJJ8YochS'
Source: AdGuard.Vpn.Common.dll.4.dr, UnhandledExceptionCallbackAdapter.cs	High entropy of concatenated method names: 'ed3mtskud', 'Di9aBSXERnvrWfragYf', 'bI6ZCbXJBDG4UlrT30W', 'bjKWEPX7F1JEYI0c1ai', 'zQAu79XciYiBQoUNovU', 'yGwthNXYEWpnGip2bZh'

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	File created: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	File created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Google.Protobuf.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\installer[1].exe	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	File created: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	File created: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Memory allocated: 36E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Memory allocated: 4650000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Thread delayed: delay time: 86400000			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll	Jump to dropped file
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Found evasive API chain checking for process token information

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

API coverage: 9.4 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe TID: 2436	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe TID: 2436	Thread sleep time: -86400000s >= -30000s			Jump to behavior

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006BF79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 006BF839h	3_2_006BF79E
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006BF79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 006BF832h	3_2_006BF79E
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002AF79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 002AF839h	4_2_002AF79E
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002AF79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 002AF832h	4_2_002AF79E

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B7437 FindFirstFileExW,	3_2_006B7437
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_00699A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	3_2_00699A1D
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006C3C72 FindFirstFileW,FindClose,	3_2_006C3C72
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A7437 FindFirstFileExW,	4_2_002A7437
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00289A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	4_2_00289A1D
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002B3C72 FindFirstFileW,FindClose,	4_2_002B3C72
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_00273D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	4_2_00273D4E
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCFBF0F FindFirstFileExA,	4_2_6CCFBF0F

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006C8EF4 VirtualQuery,GetSystemInfo,

3_2_006C8EF4

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: setup.exe.0.dr	Binary or memory string: HgFsx
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344266307.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.exe, 00000004.00000002.3925694491.00000000072B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: setup.exe.0.dr	Binary or memory string: /DaMQemuU

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006B34A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_006B34A2

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_000114F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000114F0

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B4104 mov eax, dword ptr fs:[00000030h]	3_2_006B4104
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A4104 mov eax, dword ptr fs:[00000030h]	4_2_002A4104
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF8FD6 mov eax, dword ptr fs:[00000030h]	4_2_6CCF8FD6

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_00018170 GetProcessHeap,strlen,HeapAlloc,memchr,memchr,memchr,memchr,HeapAlloc,HeapFree,GetLastError,HeapAlloc,GdiplusStartup,GetCurrentThreadId,GetDC,GetDeviceCaps,ReleaseDC,SystemParametersInfoW,GetModuleHandleW,LoadIconW,LoadCursorW,RegisterClassExW,SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,SetWindowLongW,KiUserCallbackDispatcher,ShowWindow,GetLastError,CreateThread,KiUserCallbackDispatcher,GetParent,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,WaitForSingleObject,GetExitCodeThread,CloseHandle,DeleteObject,DeleteObject,DeleteObject,GdiplusShutdown,GetModuleHandleW,UnregisterClassW,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,

0_2_00018170

Enables debug privileges

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0001117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_0001117C
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00011170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00011170
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_000111B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_000111B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_000113D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_000113D1
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AE0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_006AE0A8
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006B34A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006B34A2
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AE574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_006AE574
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 3_2_006AE707 SetUnhandledExceptionFilter,	3_2_006AE707
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029E0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0029E0A8
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_002A34A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_002A34A2
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029E574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0029E574
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_0029E707 SetUnhandledExceptionFilter,	4_2_0029E707
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF448C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6CCF448C
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF42B6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6CCF42B6
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Code function: 4_2_6CCF7F77 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6CCF7F77

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Process created: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe "C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=704 -burn.filehandle.self=712 AID=18672

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006C0FA6 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

3_2_006C0FA6

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006C32B9 AllocateAndInitializeSid,CheckTokenMembership,

3_2_006C32B9

Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006AE937 cpuid

3_2_006AE937

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: GetLocaleInfoW,GetWindowLongW,SetWindowLongW,ShowWindow,SendMessageW,SendMessageW,SendMessageW,CreateFontIndirectW,CreateSolidBrush,LoadImageW,SendMessageW,ShowWindow,ShowWindow,strlen,ShowWindow,LoadCursorW,SetWindowLongW,CreateFontIndirectW,SendMessageW,strlen,ShowWindow,

0_2_000193D8

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Installer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\SharpRaven.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_00694E6A ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

3_2_00694E6A

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_0068605F GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

3_2_0068605F

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_00686203 GetUserNameW,GetLastError,

3_2_00686203

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006C8039 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

3_2_006C8039

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 3_2_006851D2 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

3_2_006851D2

Source: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgrsx.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKService.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dwservice.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKProxy.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKTray.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dwengine.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgui.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ufnavi.exe
Source: setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: mbam.exe

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.setup.exe.75a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.setup.exe.71a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.setup.exe.76e0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.setup.exe.77e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3927775163.00000000077E2000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3927026125.00000000075A2000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll, type: DROPPED

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 4.2.setup.exe.75a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.setup.exe.71a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.setup.exe.76e0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.setup.exe.77e0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3927775163.00000000077E2000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3927026125.00000000075A2000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Network Sniffing	12 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	13 Process Injection	1 Software Packing	NTDS	1 Network Sniffing	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	35 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	31 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	31 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	1%	Virustotal		Browse
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\installer[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Installer.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Google.Protobuf.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\SharpRaven.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Data.SQLite.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ar\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\be\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\bg\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\cs\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\da\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\de\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\es\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fa\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\he\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hu\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hy\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\id\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\it\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ja\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ko\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	0%	ReversingLabs
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
1523296349.rsc.cdn77.org	0%	Virustotal	Browse
1625341327.rsc.cdn77.org	0%	Virustotal	Browse
static.adtidy.net	1%	Virustotal	Browse
static.adguard.com	0%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://system.data.sqlite.org/X	0%	Avira URL Cloud	safe
http://wixtoolset.org/news/	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Avira URL Cloud	safe
http://api.adguard.com/uninstall.html	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Avira URL Cloud	safe
http://api.adguard.com/uninstall.html	0%	Virustotal		Browse
http://wixtoolset.org/releases/SCreating	0%	Avira URL Cloud	safe
http://wixtoolset.org/news/	0%	Virustotal		Browse
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Virustotal		Browse
https://system.data.sqlite.org/X	0%	Virustotal		Browse
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	1%	Virustotal		Browse
http://wixtoolset.org/releases/SCreating	0%	Virustotal		Browse
http://appsyndication.org/2006/appsynapplicationc:	0%	Virustotal		Browse
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsynapplicationc:	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exe(	0%	Avira URL Cloud	safe
http://wixtoolset.org	0%	Avira URL Cloud	safe
https://link.adtidy.info	0%	Avira URL Cloud	safe
http://static.adguard.com/installer.v1.0.json=args	0%	Avira URL Cloud	safe
https://s10.adtidy.net:443/api/55/store/	0%	Avira URL Cloud	safe
https://static.adguard.com	0%	Avira URL Cloud	safe
http://static.adguard.com/installer.v1.0.json	0%	Avira URL Cloud	safe
http://static.adguard.com/installer.v1.0.json=args	0%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exe(	1%	Virustotal		Browse
https://s10.adtidy.net:443/api/55/store/	0%	Virustotal		Browse
https://link.adtidy.info	0%	Virustotal		Browse
https://www.getsentry.com.	0%	Avira URL Cloud	safe
http://wixtoolset.org	0%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exe.	100%	Avira URL Cloud	malware
https://static.adguard.com	0%	Virustotal		Browse
https://static.adtidy.net/windows/installer.exe&	0%	Avira URL Cloud	safe
http://static.adguard.com/installer.v1.0.json	0%	Virustotal		Browse
https://dev.adguard.com&https://adguard.com	0%	Avira URL Cloud	safe
https://static.adtidy.net/	0%	Avira URL Cloud	safe
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	0%	Avira URL Cloud	safe
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	0%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exe.	1%	Virustotal		Browse
https://static.adtidy.net/	1%	Virustotal		Browse
https://static.adtidy.net/windows/installer.exe&	1%	Virustotal		Browse
https://error.c.cdn77.org/	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Avira URL Cloud	safe
https://adguard.comd	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exe29	0%	Avira URL Cloud	safe
https://error.c.cdn77.org/	0%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exeW	0%	Avira URL Cloud	safe
http://static.adguard.com	0%	Avira URL Cloud	safe
https://static.adtidy.net/windows/installer.exeM	0%	Avira URL Cloud	safe
https://www.getsentry.com.	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Virustotal		Browse
http://james.newtonking.com/projects/json	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exeW	1%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exeR	0%	Avira URL Cloud	safe
https://kb.adguard.com/	0%	Avira URL Cloud	safe
http://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
https://vpn.website.agrd.dev.https://adguard-vpn.com0https://link.adtidy.info	0%	Avira URL Cloud	safe
http://static.adguard.com	0%	Virustotal		Browse
http://james.newtonking.com/projects/json	0%	Virustotal		Browse
https://static.adtidy.net/windows/installer.exeM	1%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exeR	1%	Virustotal		Browse
http://www.newtonsoft.com/jsonschema	0%	Virustotal		Browse
https://kb.adguard.com/	0%	Virustotal		Browse
http://wixtoolset.org/releases/	0%	Avira URL Cloud	safe
http://sentry-dsn.invalid	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exej	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Avira URL Cloud	safe
http://wixtoolset.org/releases/	0%	Virustotal		Browse
https://www.getsentry.com	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exe	100%	Avira URL Cloud	malware
http://wixtoolset.org/	0%	Avira URL Cloud	safe
http://wixtoolset.org/telemetry/v	0%	Avira URL Cloud	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	Avira URL Cloud	safe
https://static.adguard.com/installer.v1.0.json	0%	Avira URL Cloud	safe
https://adguard.com	0%	Avira URL Cloud	safe
https://system.data.sqlite.org/	0%	Avira URL Cloud	safe
https://s10.adtidy.net:443/api/embed/error-page/	0%	Avira URL Cloud	safe
https://static.adtidy.net/windows/installer.exe	100%	Avira URL Cloud	malware
http://api.adguard.com/FDefault	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsyn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
1523296349.rsc.cdn77.org	212.102.56.179	true	false	0%, Virustotal, Browse	unknown
1625341327.rsc.cdn77.org	156.146.33.138	true	false	0%, Virustotal, Browse	unknown
static.adtidy.net	unknown	unknown	false	1%, Virustotal, Browse	unknown
static.adguard.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://static.adguard.com/installer.v1.0.json	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adguard.com/installer.v1.0.json	false	Avira URL Cloud: safe	unknown
https://static.adtidy.net/windows/installer.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.adguard.com/uninstall.html	setup.exe, 00000004.00000002.3924968992.0000000006F62000.00000002.00000001.01000000.0000000F.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://system.data.sqlite.org/X	System.Data.SQLite.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/news/	setup.exe, setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/releases/SCreating	setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	setup.exe, 00000003.00000002.3920265492.0000000003140000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2343102018.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3918974616.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2342942227.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3922246145.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2361338341.0000000001666000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3919679979.0000000001630000.00000004.00000020.00020000.00000000.sdmp, BootstrapperApplicationData.xml.4.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsynapplicationc:	setup.exe, 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000003.00000000.2341636279.00000000006CA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.3918348366.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000004.00000000.2346193381.00000000002BA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exe(	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2343930546.000000000125E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org	BootstrapperCore.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://link.adtidy.info	setup.exe, setup.exe, 00000004.00000002.3924968992.0000000006F62000.00000002.00000001.01000000.0000000F.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.com/installer.v1.0.json=args	setup.exe, 00000004.00000002.3923329796.00000000049F2000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://s10.adtidy.net:443/api/55/store/	setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adguard.com	setup.exe, 00000004.00000002.3923483607.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.getsentry.com.	setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://static.adtidy.net/windows/installer.exe.	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://static.adtidy.net/windows/installer.exe&	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2343930546.000000000125E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344266307.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012E6000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
https://dev.adguard.com&https://adguard.com	setup.exe, 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adtidy.net/	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2343032241.0000000001292000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2343930546.0000000001292000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	setup.exe, 00000004.00000002.3922438209.00000000046F2000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://error.c.cdn77.org/	setup.exe, 00000004.00000002.3923483607.0000000004B8C000.00000004.00000800.00020000.00000000.sdmp, installer[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://adguard.comd	setup.exe, 00000004.00000002.3919679979.000000000168E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2361546962.000000000168E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2361338341.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exe29	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exeW	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adtidy.net/windows/installer.exeM	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.com	setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kb.adguard.com/	setup.exe, 00000003.00000002.3920265492.0000000003140000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3918974616.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3922246145.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3919679979.0000000001630000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exeR	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344181138.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012A9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012A6000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vpn.website.agrd.dev.https://adguard-vpn.com0https://link.adtidy.info	setup.exe, 00000004.00000002.3924968992.0000000006F62000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/releases/	setup.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sentry-dsn.invalid	setup.exe, setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exej	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2342770809.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.2344266307.00000000012E6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.2332716828.00000000012E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.Installer.dll.4.dr, setup.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.getsentry.com	setup.exe, setup.exe, 00000004.00000002.3927314498.0000000007682000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exe	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	false	Avira URL Cloud: malware	unknown
http://wixtoolset.org/	setup.exe	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/telemetry/v	setup.exe	false	Avira URL Cloud: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Newtonsoft.Json.dll.4.dr	false	Avira URL Cloud: safe	unknown
https://adguard.com	setup.exe, 00000003.00000002.3920265492.0000000003140000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2343102018.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3918974616.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2342942227.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3922246145.0000000003A50000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://system.data.sqlite.org/	System.Data.SQLite.dll.4.dr	false	Avira URL Cloud: safe	unknown
https://s10.adtidy.net:443/api/embed/error-page/	setup.exe, 00000004.00000002.3923483607.0000000004AAF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.adguard.com/FDefault	setup.exe, 00000004.00000002.3923483607.0000000004BBA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsyn	setup.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.102.56.179	1523296349.rsc.cdn77.org	Italy		60068	CDN77GB	false
156.146.33.138	1625341327.rsc.cdn77.org	United States		3743	ARCEL-2US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461053
Start date and time:	2024-06-22 06:38:42 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
Detection:	MAL
Classification:	mal57.troj.evad.winEXE@5/100@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 189 Number of non-executed functions: 277
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.119.148.38
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
212.102.56.179	https://dutchpopp.com	Get hash	malicious	Unknown	Browse
212.102.56.179	https://interface01.nsxtlmv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
156.146.33.138	https://web.streamlinevrs.com/pmt_common/redirect/email_292045603.script?url=//lzKmqliM.ortopediajk.com.br/godsendd/	Get hash	malicious	Unknown	Browse
	https://giantscreening.onlinesacs.com/refereeportal/02000000F85F4B85FCB47421E548FF6F74DE3F0CA330D6F27E705AEA99C493357AE61A9AD2C3AE435C2ED0D2569E30B1D90DD981	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	http://h-mconsulting.com/sae3/index.html	Get hash	malicious	HTMLPhisher	Browse
	http://www.trillertv.com	Get hash	malicious	Unknown	Browse
	https://biogenicalatam.com/	Get hash	malicious	Unknown	Browse
	http://bencrump.com	Get hash	malicious	Unknown	Browse
	http://cdn.camvenue.live	Get hash	malicious	Unknown	Browse
	776LO9J7.html	Get hash	malicious	Unknown	Browse
	http://ifdnzact.com/?dn=ryainair.com&pid=9PO755G95	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1625341327.rsc.cdn77.org	__.exe	Get hash	malicious	PureLog Stealer	Browse	156.146.33.15
	__.exe	Get hash	malicious	PureLog Stealer	Browse	195.181.170.18
	TsU2RShnl7.exe	Get hash	malicious	PureLog Stealer	Browse	156.146.36.23
1523296349.rsc.cdn77.org	__.exe	Get hash	malicious	PureLog Stealer	Browse	195.181.175.40
	__.exe	Get hash	malicious	PureLog Stealer	Browse	195.181.175.40
	TsU2RShnl7.exe	Get hash	malicious	PureLog Stealer	Browse	156.146.36.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARCEL-2US	arm4.elf	Get hash	malicious	Mirai	Browse	156.144.159.185
	ATT001_PlayVM.html	Get hash	malicious	Unknown	Browse	156.146.33.15
	https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379	Get hash	malicious	Unknown	Browse	156.146.33.141
	https://web.streamlinevrs.com/pmt_common/redirect/email_292045603.script?url=//lzKmqliM.ortopediajk.com.br/godsendd/	Get hash	malicious	Unknown	Browse	156.146.33.138
	https://giantscreening.onlinesacs.com/refereeportal/02000000F85F4B85FCB47421E548FF6F74DE3F0CA330D6F27E705AEA99C493357AE61A9AD2C3AE435C2ED0D2569E30B1D90DD981	Get hash	malicious	Unknown	Browse	156.146.33.138
	Setup (1).exe	Get hash	malicious	Unknown	Browse	156.146.33.138
	https://pikara-campaign.com/st-manager/click/track?id=300&type=classic&url=https://melaminafatima.com/antibot%23Aminor%2Bccfi.com&source_url=https%3A%2F%2Fpikara-campaign.com%2Fnext%2F&source_title=%E3%83%94%E3%82%AB%E3%83%A9%E5%85%89%E3%81%AD%E3%81%A3%E3%81%A8%20%E3%81%8A%E3%81%99%E3%81%99%E3%82%81%20%E4%BB%A3%E7%90%86%E5%BA%97%E3%80%8C%E6%A0%AA%E5%BC%8F%E4%BC%9A%E7%A4%BENEXT%E3%80%8D%E3%81%AE%E3%82%AD%E3%83%A3%E3%83%83%E3%82%B7%E3%83%A5%E3%83%90%E3%83%83%E3%82%AF%E3%82%AD%E3%83%A3%E3%83%B3%E3%83%9A%E3%83%BC%E3%83%B3%EF%BC%BB%E6%9C%80%E6%96%B0%E6%83%85%E5%A0%B1%3A%202024%E5%B9%B46%E6%9C%883%E6%97%A5%28%E6%9C%88%29%EF%BC%BD	Get hash	malicious	HTMLPhisher	Browse	156.146.33.14
	Updated contract doc.one	Get hash	malicious	HTMLPhisher	Browse	156.146.33.14
	BWzZ0rQSWQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.146.78.53
CDN77GB	Complete with Docusign chelsea.pdf	Get hash	malicious	Unknown	Browse	195.181.175.40
	https://ipfs.io/ipfs/QmZ1uhxgG3izsY4KucbZqswPgFWzecvF4LdbKLjXvQGnuB	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://u2939254.ct.sendgrid.net/ls/click?upn=u001.TKkwJSV9-2Fws5TpW3RQYs99-2FBeVmlunHf0-2F0CNCHqilOzq-2FQpvRNOxYwhUCotajdtwjCOFaYozqKxQhX3g0Kizaz7Ru-2Fk-2BlOd-2F1uK-2BpGDXCaTK-2B6z7qKyUi9woDQPY-2FYUM0znDc4drOXLxEnjLiSwuelV-2FcqhQ9mNXyE3xT-2BrXiA-3DA0a2_h5tndX3XP82u2CVP7HmVo-2BgFxiBMXo9LX8o14HIIdhsriIms-2FUknD2cTodKM-2FG-2BB9ZTfUIQeE84DwPuu-2BAGswZMh5IWYH7OqErdwsWz0turUA5IBflIOJpCg6Fr42WxbThk2nslgtkkmPKHYXH9XoaCJns8LSyquGX2eO-2FsQnWJ-2BoOQAlHUReelXX-2FXslzAQzPE5mOJZ-2BwAn0YnlEjzIwQ-3D-3D	Get hash	malicious	Unknown	Browse	185.93.1.244
	http://bafybeih5dsh26i36hhp5qj33lwgon7pkgoaeqnfk7tj5et7nfapgzeztzu.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	185.93.3.244
	https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379	Get hash	malicious	Unknown	Browse	212.102.56.178
	https://ipfs.io/ipfs/bafybeighp4krlvehs33pimsa3ka7aimkt3miqblm5arwkobl432i3aysgq/WeTransfer%20domain.html/	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://rb.gy/s9lzwt	Get hash	malicious	Unknown	Browse	185.93.3.244
	https://giantscreening.onlinesacs.com/refereeportal/02000000F85F4B85FCB47421E548FF6F74DE3F0CA330D6F27E705AEA99C493357AE61A9AD2C3AE435C2ED0D2569E30B1D90DD981	Get hash	malicious	Unknown	Browse	212.102.56.178
	Setup (1).exe	Get hash	malicious	Unknown	Browse	195.181.170.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Kf1Rr6jArf.exe	Get hash	malicious	Phemedrone Stealer	Browse	156.146.33.138
	INQUIRY.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	156.146.33.138
	Data-Sheet.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	156.146.33.138
	z26SZO98764590000000980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	156.146.33.138
	oTfjRHJdWzffhcnPGd.exe	Get hash	malicious	AgentTesla	Browse	156.146.33.138
	MT Sea Gull 9 Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	156.146.33.138
	E9231UlgL8.exe	Get hash	malicious	Xehook Stealer	Browse	156.146.33.138
	E9231UlgL8.exe	Get hash	malicious	Xehook Stealer	Browse	156.146.33.138
	ESItm2CpzS.exe	Get hash	malicious	Xehook Stealer	Browse	156.146.33.138
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Trojan.Siggen16.24785.7080.9620.exe	Get hash	malicious	Unknown	Browse	212.102.56.179
	SecuriteInfo.com.Trojan.Siggen16.24785.7080.9620.exe	Get hash	malicious	Unknown	Browse	212.102.56.179
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	212.102.56.179
	Setup.exe	Get hash	malicious	Vidar	Browse	212.102.56.179
	SecuriteInfo.com.Win64.MalwareX-gen.18256.27985.exe	Get hash	malicious	Unknown	Browse	212.102.56.179
	SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll	Get hash	malicious	Unknown	Browse	212.102.56.179
	SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll	Get hash	malicious	Unknown	Browse	212.102.56.179
	file.exe	Get hash	malicious	Vidar	Browse	212.102.56.179
	decrypted.exe	Get hash	malicious	Vidar	Browse	212.102.56.179

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll	__.exe	Get hash	malicious	PureLog Stealer	Browse
	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\installer[1].exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
	__.exe	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\installer[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33343848
Entropy (8bit):	7.99712793939824
Encrypted:	true
SSDEEP:	786432:XHnNMV7aaAYes29D4EDzuwWJYXoJPYaKFphuSDe:3nKV7aPZiEDzuwWJY4Jwdrhu3
MD5:	B005E4007EB93F23BB0E7F03FB634D46
SHA1:	2DDD20CC6B44752BAA19A8C871233ADE7F27BBFC
SHA-256:	0CB50652E644A2DBA3B47BF2D55ACDD27CE1007286B37E615C6C7C115BA0A4EA
SHA-512:	992DBA117A2E7076BE418537C09B4028089F4DF3E2F2723C7EA91E96EFAA3246A062C8A399E5209BA8B1497FE0B1B4B64308F9EC9BEE924EC06949990882C366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@.................................h.....@.............................................T................,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\installer[1].htm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	777
Entropy (8bit):	4.815544866815673
Encrypted:	false
SSDEEP:	12:hSn2O6Qclfhxts9FQ60hFP4xs4uXRLdJpQNVly/tb:hSfspxts9qHbBXRhnQNVWR
MD5:	01E3AA88E44D1AF26E5E72E37789700F
SHA1:	42DC835234D93A0FA06840FD1B503D163F2884E2
SHA-256:	F9FE349F77B616337B4DD30016151B9D017C4C9B28581CB96C336A3E5649FB6E
SHA-512:	79F502DBF0056B3372CAB28350592ACA30A455CC1C250466F845508F211F036003E1502468001C5770611694876D22B57143ED9CA9E789F2B4071BCD8DC1243C
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<head>. <base href="https://error.c.cdn77.org/" target="_blank">. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">. <meta name="author" content="(c) 2023 CDN77">. <meta name="viewport" content="width=device-width, initial-scale=1">. <link rel="stylesheet" href="css/main.css">. <link rel="shortcut icon" href="img/favicon.ico" />.. <title>Moved Permanently</title>.</head>.<body style="background-color: #0d5284; color: #fff;" class="Header-wrap">. <h1>. <small class="Header-errorNumber">. 301 Redirect</small><br>. Moved Permanently. </h1>. <p class="Header-desc-description">. This resource has been permanently moved to a new location.</p>.</body>.

C:\Users\user\AppData\Local\Temp\AdguardVPN\AdguardVPN_20240622004005.log

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	ASCII text, with very long lines (309), with CRLF line terminators
Category:	dropped
Size (bytes):	14882
Entropy (8bit):	5.312625592164506
Encrypted:	false
SSDEEP:	96:ruGHMLtxS90VWheZ/omdsFdAYYX3fKfuB9kgZ7ZKnSJG2GgjGvGowo6KG2+yLRcZ:KWoxhZwmdsk4ZhGoaKiQRpddQ
MD5:	FFB82C485265D8E6F11B3D383D0ED393
SHA1:	0A88DAF94311FA89975356A05EF894D97EC67EB4
SHA-256:	4219A0E8BEB01A42D5523D92FF92E18EBAA81E02DA3BAFA1DB68FDF88A83E156
SHA-512:	3A9EBC1F4E5713B5C4306CE203D78D006F3DF45BBADA7103B6AB79F50EA6E714F9B1D9B57E68F07920ECD4F204D82475EE7AE70AC133C78DD3CE45E6C4390676
Malicious:	false
Reputation:	low
Preview:	[12B4:159C][2024-06-22T00:40:03]i001: Burn v3.11.2.4516, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'AID' to value ''..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'CID' to value ''..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'REMOVE_SETTINGS' to value 'NO'..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'SHOW_UNINSTALL_PAGE' to value 'YES'..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'NORUN' to value ''..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'INSTALLDESKTOPSHORTCUT' to value ''..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'INSTALLLOCATION' to value ''..[12B4:159C][2024-06-22T00:40:03]i000: Initializing string variable 'BUNDLE_KEY' to value '[WixBundleProviderKey]'..[12B4:159C][2024-06-22T00:40:03]i000: I

C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33343848
Entropy (8bit):	7.99712793939824
Encrypted:	true
SSDEEP:	786432:XHnNMV7aaAYes29D4EDzuwWJYXoJPYaKFphuSDe:3nKV7aPZiEDzuwWJY4Jwdrhu3
MD5:	B005E4007EB93F23BB0E7F03FB634D46
SHA1:	2DDD20CC6B44752BAA19A8C871233ADE7F27BBFC
SHA-256:	0CB50652E644A2DBA3B47BF2D55ACDD27CE1007286B37E615C6C7C115BA0A4EA
SHA-512:	992DBA117A2E7076BE418537C09B4028089F4DF3E2F2723C7EA91E96EFAA3246A062C8A399E5209BA8B1497FE0B1B4B64308F9EC9BEE924EC06949990882C366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@.................................h.....@.............................................T................,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1028\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2025
Entropy (8bit):	6.231406644010833
Encrypted:	false
SSDEEP:	48:cxX7DTAT8tMBCus9T3FVWmHdniarRFeOrw8Nhv2VyfN3mKNWFP44SBWWW1GyfiPq:8L4T2RJhfHP8+VYuTmQUc2mE
MD5:	1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA1:	1B3ED82655AEC8A52DAEC60F8674BC7E07F8CFEB
SHA-256:	1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
SHA-512:	C6CCB188281F161DEBF02DCDDE24B77D8D14943DEED8852E77E5AFB18F3F62683AB1AE06DCEB1E09D53804A76DF6400A360712D8E7E228B7F971054BB4FB2496
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-tw" Language="1028" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName] ...... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ...... UI ............ UI ... ........... UI ........../norestart - ................UI ............./log log.txt - ............ %TEMP% ......</String>.. <Stri

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1029\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2458
Entropy (8bit):	5.36165936198009
Encrypted:	false
SSDEEP:	48:cxX7DTZT8u9cktosM6re4mSTcIIyfI7sh/DMNwIHWAoN3mepNRfKPnWZ0hqAQZfC:8LxTK23f33AwIViRrRynRuZfiMS
MD5:	CC8C6D04DC707B38E0F0C08BA16FE49B
SHA1:	95EA7F570677AEA52393D02FDB21CEBB218A7343
SHA-256:	DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
SHA-512:	A4B19EBC8BB0D88ABA7D3D5783E28F8B6E0960582A540059BC71076B1203BF43BCA15EA726272D15395C7B4E431046ADA1CBB9D55072BBC5DBE7729C4599F0E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="cs-cz" Language="1029" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalace produktu [WixBundleName]</String>.. <String Id="Title">Pro instalaci produktu [WixBundleName] je vy.adov.no rozhran. Microsoft .NET Framework.</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/passive \| /quiet - Zobraz. minim.ln. u.ivatelsk. rozhran. bez jak.chkoli.. v.zev, nebo nezobraz. ..dn. u.ivatelsk. rozhran. ani ..dn. v.zvy. Ve v.choz.m.. nastaven. se jak u.ivatelsk. rozhran., tak i v.echny v.zvy zobrazuj....../norestart - Potla.. jak.koli p

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1030\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	5.061915970731254
Encrypted:	false
SSDEEP:	48:cxX7DCrT81tbzjamsjFq7LhzqGgdRDJNbqoN3mpN+ELPnfyOwYxPyzraXnAF:8LaTOkaEOiGd/BwF
MD5:	7C6E4CE87870B3B5E71D3EF4555500F8
SHA1:	E831E8978A48BEAFA04AAD52A564B7EADED4311D
SHA-256:	CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
SHA-512:	2A02415A3E5F073F4530FD87C97B685D95B8C0E1B15EFD185CC5CB046FCF1D0DCE28DB9889AD52588B96FE01841A7A61F6B7D6D2F669EAB10A8926C46B8E93D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="da-dk" Language="1030" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation af [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework skal v.re installeret i forbindelse med Installationen af [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Er du sikker p., at du vil annullere?</String>.. <String Id="HelpHeader">Hj.lp til installation</String>.. <String Id="HelpText">/passive \| /quiet - viser en minimal brugergr.nseflade uden prompter eller.. viser ingen brugergr.nseflade og ingen prompter... Brugergr.nsefladen og alle prompter vises som standard...../norestart - skjuler fors.g p. genstart. Der vises som standard en.. foresp.rgse

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1031\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	5.094465051245675
Encrypted:	false
SSDEEP:	48:cxX7DASTcCwit/soJy9hkVByUZN+29N3mfN65PS9CvZwZi7uuASD:8LxT8itGeVB97+gyC9BdaSD
MD5:	C8E7E0B4E63B3076047B7F49C76D56E1
SHA1:	4E44E656A0D552B2FFD65911CB45245364E5DBF3
SHA-256:	631D46CB048FB6CF0B9A1362F8E5A1854C46E9525A0260C7841A04B2316C8295
SHA-512:	FD7E8896F9414F0DB7A88F926F55EE24E0591DA676F330200BC6BB829EB32648D90D3094E0011BFE36C7BA8BE41DFD74B12D444AFEA0D2866801258DA4FA16E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="de-de" Language="1031" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <UI Control="InstallButton" Width="180" />.. .. <String Id="Caption">[WixBundleName]-Setup</String>.. <String Id="Title">F.r das [WixBundleName]-Setup ist Microsoft .NET Framework erforderlich.</String>.. <String Id="ConfirmCancelMessage">Sind Sie sicher, dass Sie den Vorgang abbrechen m.chten?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne.. Eingabeaufforderungen oder keine Benutzeroberfl.che und keine.. Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und.. alle Eingabeaufforderungen angezeigt...../no

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1032\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3400
Entropy (8bit):	5.279888750092028
Encrypted:	false
SSDEEP:	48:cxX7D8jVT8dUk9Ug/usOo2pNSBIbESvR2drdESPzghC76DeN2hL0eLoN3mOLSNIx:8L45TCyop5riGzH7xgJit8IqSsBwqk
MD5:	074D5921AF07E6126049CB45814246ED
SHA1:	91D4BDDA8D2B703879CFE2C28550E0A46074FA57
SHA-256:	B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
SHA-512:	28DAC36516BCC76BCC598C6E7ABDE359695F85AB7A830D6ADBC844EB240D9FA372CB5A5CE4DBE21E250408C6B246D371D3CDD656D2178FB0EC22DAC7D39CBD9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="el-gr" Language="1032" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">........... ... [WixBundleName]</String>.. <String Id="Title">... ... ........... ... [WixBundleName] .......... .. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">..... ....... ... ...... .. ..... .......;</String>.. <String Id="HelpHeader">....... ... ... ...........</String>.. <String Id="HelpText">/passive \| /quiet - ......... ........ ........... ... ............. .......... ...... ..... ........ . ... ..

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1035\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2235
Entropy (8bit):	5.142592159444541
Encrypted:	false
SSDEEP:	48:cxX7DE+T8Z+bm5snwETMAoQEATN27uNBDReq4N3mJeNHNP64NsFKJJem4vyAs:8LZTDkZ7+2IBCht6J8neHs
MD5:	E338408F1101499EB22507A3451F7B06
SHA1:	83B42F9D7307265A108FC339D0460D36B66A8B94
SHA-256:	B7D9528F29761C82C3D926EFE5E0D5036A0E0D83EB4CCA7282846C86A9D6F9F3
SHA-512:	F7BE923DC2856E0941D0669E2DE5A5C307C98DC7EBA0A1B68728EB29C95B4625145C2AD3AC6F6B6D82F062887EA349E2187F1F91785DDE5A5083BC1150E56326
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fi-fi" Language="1035" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] -asennus</String>.. <String Id="Title">Microsoft .NET Framework tarvitaan [WixBundleName] -asennusta varten</String>.. <String Id="ConfirmCancelMessage">Haluatko varmasti peruuttaa?</String>.. <String Id="HelpHeader">Asennusohjelman ohje</String>.. <String Id="HelpText">/passive \| /quiet - n.ytt.. mahdollisimman v.h.n k.ytt.liittym.st.; ei.. kehotteita tai ei k.ytt.liittym.. ja kehotteita. Oletusarvoisesti.. k.ytt.liittym. ja kaikki kehotteet n.ytet..n...../norestart - est.. uudelleenk.ynnistysyritykset. Oletusarvoisesti.. k.ytt.liittym. kysyy ennen uudelleenk.yn

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1036\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	5.076293283609686
Encrypted:	false
SSDEEP:	48:cxX7DyBT81BbKBswAL1xV1wjRcDSNwDXoN3mSZfNhkLPkQpznsdMEodAY:8LwTK5KHsijmEXY
MD5:	AA32A059AADD42431F7837CB1BE7257F
SHA1:	4CD21661E341080FB8C2DEFD9F32F134561FC3BA
SHA-256:	88E7DDACD6B714D94D5322876BD50051479B7A0C686DC2E9EB06B3B7A0BC06C9
SHA-512:	78E201F369E65535E25722DFC0EFE99EDF641F7C14EFF1526DC1CC047FF11640079F1E3D25C9072CF25F4804195891BE006FC5ED313063AFCB91FB5700120B88
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fr-fr" Language="1036" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework requis pour l'installation de [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.tes-vous s.r de vouloir annuler.?</String>.. <String Id="HelpHeader">Aide de l'installation</String>.. <String Id="HelpText">/passive \| /quiet - affiche une interface minimale sans invites ou n'affiche.. aucune interface ni aucune invite. Par d.faut, l'interface et toutes les.. invites sont affich.es...../norestart - annule toute tentative de red.marrage. Par d.faut, l'interface.. affiche une invite avant de red.marrer..

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1038\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	5.293225307744296
Encrypted:	false
SSDEEP:	48:cxX7DwzT8cSwvs48mF7GD/g1v0wH7N3wwJxL99oN3m/ZNRUYPBZRT1XESW3o/ULG:8LQT2wpFGbgT3wMN2QRj/y/LKr
MD5:	17FB605A2F02DA203DF06F714D1CC6DE
SHA1:	3A71D13D4CCA06116B111625C90DD1C451EA9228
SHA-256:	55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
SHA-512:	D05008D37143A1CC031F4B6268490A5A10FBB686C86984D20DB94843BDC4624EF9651D158DCB5B660FC239C3C3E8D087EB5D23FFFB8C4681910CBC376148F0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="hu-hu" Language="1038" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] telep.t.</String>.. <String Id="Title">A(z) [WixBundleName] telep.t.s.hez Microsoft .NET-keretrendszer sz.ks.ges</String>.. <String Id="ConfirmCancelMessage">Biztosan megszak.tja?</String>.. <String Id="HelpHeader">A telep.t. s.g.ja</String>.. <String Id="HelpText">/passive \| /quiet - Minim.lis felhaszn.l.i fel.let megjelen.t.se k.rd.sek.. n.lk.l, illetve felhaszn.l.i fel.let .s k.rd.sek megjelen.t.se n.lk.li.. telep.t.s. Alapesetben a felhaszn.l.i fel.let .s minden k.rd.s megjelenik...../norestart - Az .jraind.t.si k.r.sek elrejt.se. Alapeset

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1040\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.985260685429469
Encrypted:	false
SSDEEP:	48:cxX7DQyT81ebRcesyB+lY25ukVpkXJM2DJNXhpXZoN3mMhNTM+POYO/n1YxXlcI5:8LFTzLtkfwWKXHZi37MIDp
MD5:	50261379B89457B1980FF19CFABE6A08
SHA1:	F80B1F416539D33206CE3C24BA3B14B799A84813
SHA-256:	A40C94EB33F8841C79E9F6958433AFFD517F97B4570F731666AF572E63178BB7
SHA-512:	BBD9794181EEC95D6BE7A1B7BA83FD61AF2B2DF61D9DA8DDA2788B61BEC53C30FCEFE5222EDF134166532B36D3AB6CE8996F2D670DC6907C1864AF881A21EA40
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="it-it" Language="1040" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework necessario per l'installazione di [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida dell'installazione</String>.. <String Id="HelpText">/passive \| /quiet - visualizza l'interfaccia utente minima senza istruzioni.. oppure non visualizza n. l'interfaccia utente n. le istruzioni. Per.. impostazione predefinita vengono visualizzate interfaccia utente e.. istruzioni...../norestart - elimina eventuali tentativi di riavvio. Per impostazione.. predefinita l'int

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1041\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2545
Entropy (8bit):	5.923292576429967
Encrypted:	false
SSDEEP:	48:cxX7DpcYT86WyscLpTIFw6tnOUjsj/D3NIgHcQN3mKN/WPOhT0SXsDay+z8QZEcE:8L1TccOFw6tnOUjsjpICnlOO934apWz
MD5:	DB0F5BAB42403FD67C0A18E35E6880EC
SHA1:	C0A18C8C5BCD7B88C384B5304B56EEB85A0DA3DC
SHA-256:	CCDCDB111EFA152C5F9FF4930033698B843390A549699AE802098D87431F16FE
SHA-512:	589522BD4A26BF54CCF3564E392E41BBBA4E7B3FD1ED74E7F4F6AD6F2E65CDE11FFF32D0C5F3BCD09052FE5110FDC361D1926E220FD0BAD2D38CAC21BBE93211
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ja-jp" Language="1041" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ......</String>.. <String Id="Title">[WixBundleName] ........ Microsoft .NET Framework .....</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/passive \| /quiet - ... UI ....................UI.. .............. .....UI ....................../norestart - ........................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1042\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2236
Entropy (8bit):	5.97627825234954
Encrypted:	false
SSDEEP:	48:cxX7D3sT8ZeusKOwOWGyKCstFmhENI2Y+kN3mp4iNmi6IPa0dDaoIunvZqIHU5UH:8LQTXvRFhIzl44wmgko04U5TY
MD5:	442F8463EF5CA42B99B2EFACA696BD01
SHA1:	67496DB91CBAA85AC0727B12FC2D35E990537DAC
SHA-256:	D22F6ADA97DBFFC1E7548E52163807F982B30B11A2A5109E71F42985102CCCBD
SHA-512:	A350EAF9E7AEAFAB1163D7C0B8D014AFE07EE98BAE3915CBDD3C26282E345A0838E853C89BAE8943474758DCBCFD0BB0724A0C75CBF969F321FAB4944E8704FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ko-kr" Language="1042" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] ... ... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/passive \| /quiet - ... .. .. UI. ..... UI. .... .... .... ..... ..... UI . .. .... ........../norestart - .. ..... ... ...... ..... UI. .. .... .. .... ......../log log.txt - .

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1043\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.965432037520827
Encrypted:	false
SSDEEP:	48:cxX7DK1T8u7hbU7Asd7MqpSwzCcHGFN9OsNN3mvoNBC7hPFtO7+xw7t0Yza2Al:8LcTtpGLFSwJHmPnnKhEBtsl
MD5:	67F28BCDB3BA6774CD66AA198B06FF38
SHA1:	85D843B7248A5E1173FF9BD59CB73BB505F69B66
SHA-256:	226B778604236931B4AE45F6F272586C884A11517444A34BF45CD5CAE49BE62E
SHA-512:	7BC7D3E6E19ECF865B2CABFC46C75D516561D5A8A81A8ED55B4EDBA41A13A7110F474473740200AFB035B9597A2511D08C2A2E7A9ADE2C2AB4D3F168944B8328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nl-nl" Language="1043" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installatie</String>.. <String Id="Title">Microsoft .NET Framework is vereist voor installatie [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Weet u zeker dat u de installatie wilt annuleren?</String>.. <String Id="HelpHeader">Help bij Setup</String>.. <String Id="HelpText">/passive \| /quiet - geeft een minimale gebruikersinterface weer zonder prompts.. of geeft geen gebruikersinterface en geen prompts weer. Gebruikersinterface.. en alle prompts worden standaard weergegeven...../norestart - pogingen tot opnieuw opstarten onderdrukken... Gebruikersinterface vraagt standaard al

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1044\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.089922193759582
Encrypted:	false
SSDEEP:	48:cxX7DTeT8uUbnFdsLnFHv+Gpm1qL5DQNDDaoN3mpZfN15dPnfuOOg5wZ5uAq8fAS:8L+Tec1x8Siule4S
MD5:	5454F724C9CDAB8172678A1CC7057220
SHA1:	241A57018ACE1210881583A9CF646E7D2E51412F
SHA-256:	41545AC1247B61C3C3E2A7E4659D9FAD2BCCA8347C69F2EB7B9D0CF5FC31E113
SHA-512:	40E311EADA299996E32A7D35223CA678A03C869D63C023D59BC97A7B2049B0252AA9D0A7EC8558D5ACB73BD14C7BFA913097E65ABEE7455658DB7E35BBDA8AE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nb-no" Language="1044" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installasjonsprogram</String>.. <String Id="Title">Microsoft .NET Framework kreves for [WixBundleName]-installasjon</String>.. <String Id="ConfirmCancelMessage">Er du sikker p. at du vil avbryte?</String>.. <String Id="HelpHeader">Installasjonshjelp</String>.. <String Id="HelpText">/passive \| /quiet - viser minimalt brukergrensesnitt uten ledetekster, eller.. ikke noe brukergrensesnitt og ingen ledetekster. Som standard vises.. brukergrensesnitt og alle ledetekster...../norestart - undertrykker alle fors.k p. omstart. Som standard sp.r.. brukergrensesnittet f.r omstart.../log log.txt

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1045\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	5.270514043715206
Encrypted:	false
SSDEEP:	48:cxX7Du4OT82gXusarwkfpYrKD8DTNkbNuoN3mjbsNniIPh8ynN1NYd4iYuffAL:8LKTsXgpYr2IyoiiOffpT3L
MD5:	96ACAAA5AEF7798E9048BAFF4C3FA8D3
SHA1:	E76629973F6C1CFC06F60BA64FE9F237B2DB9698
SHA-256:	F4AA983E39FB29C95E3306082F034B3A43E1D26489C997B8E6697B6A3B2F9F3C
SHA-512:	964F73E572BDCB1AD946C770E6A2FB4A1CE54AF4B5BB072F64256083BA27A223F4DAD4A95B9D2A646180806D1F977726147970B06AAC35EED75AEC6CA89ED337
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pl-pl" Language="1045" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator programu [WixBundleName]</String>.. <String Id="Title">Do zainstalowania programu [WixBundleName] jest wymagany program Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Pomoc instalatora</String>.. <String Id="HelpText">/passive \| /quiet - wy.wietla minimalny interfejs u.ytkownika bez monit.w.. lub nie wy.wietla interfejsu u.ytkownika ani monit.w. Domy.lnie jest.. wy.wietlany interfejs u.ytkownika i wszystkie monity...../norestart - pomija wszelkie pr.by ponownego uruchomienia. Domy.lnie.. interf

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1046\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.130635342194656
Encrypted:	false
SSDEEP:	48:cxX7DuoT85b0s/4TDoYDj4NF5j2hN3mMNYskPDXKIMaKcP9A5g:8L1TmBHjs59M8r6
MD5:	BD39ADB6B872163FD2D570028E9F3213
SHA1:	688B8A109688D3EA483548F29DE2E57A8A56C868
SHA-256:	ECB5C22E6C2423CAF07AEBE69F4FAF22450164EEE9587B64EF45A2D7F658CA15
SHA-512:	F2826BE203E767D09FF0D7677E1CF5B13113B773D529166DAE02A1F5DB2DC58E0856A34901DF70011EBABB6E964FAB7ACF38590E650BD629D4E4DC4CB36C8D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-br" Language="1046" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">Microsoft .NET Framework . necess.rio para instala..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/passive \| /quiet - exibe UI m.nima sem avisos ou exibe sem UI e.. sem avisos. Por padr.o a UI e todos avisos s.o exibidos...../norestart - suprime qualquer tentativa de reinicializa..o. Por padr.o a UI.. ir. solicitar antes de reiniciar.../log log.txt - logs para um arquivo espec.fico. Por padr.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1049\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.408094213063887
Encrypted:	false
SSDEEP:	48:cxX7DkTT8fjtEeusogrohY2Ar7DHNnjTh53oN3miRMNKrdPin+/uYcbSkuEIcOvG:8LYT8EeHMMJRNi1Ruwi3OwL
MD5:	DAF167AF4031EF47E562056A7D51AA73
SHA1:	0156B230CADD6169AC2820865E3C031ED79785EF
SHA-256:	C91C9E87AB4A6DB078F1991F4A2CDC726B58A40E47BCE49D39168A8F8F151C3B
SHA-512:	5E87EE3838E3595ADBD7EABA6E3E33CDFEA5E15ED716FBCCDBD55235B3E53E1E41EA5A907F425E96C35167543C7F75AC5214B5AEE177D299FC2464A68B22851E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ru-ru" Language="1049" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">......... [WixBundleName]</String>.. <String Id="Title">... ......... [WixBundleName] ......... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........ ........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/passive \| /quiet - ........... ............ .. ... ........ ... ...... ... .. .. . ............ .. ......... ............ .. . ... ......

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1051\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.397882326481071
Encrypted:	false
SSDEEP:	48:cxX7D+cT8muPusz2qs1u+Vh1TqDINHZJoN3m8fN0vPp3OAwa2ywSODAm:8L1TuPdKNzfifFmcatm
MD5:	016C278E515F87F589AD22C856B201F7
SHA1:	F20C7DB38B3161B143DEC4E578CE71D7F585F436
SHA-256:	4A7FDF4A9033FE05C31F565ED3AE5B8C67D324B7AEADB737CE95DBB416D46868
SHA-512:	310C85B27E1ECF4C6729E88051037150CFBA0234A0138666C26662B3D665FF38B74E95ABCADDEEF6CBEBB23E3357FAC487E6EE5EB8FE158C269D77672191B042
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sk-sk" Language="1051" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] . in.tal.cia</String>.. <String Id="Title">Na in.tal.ciu aplik.cie [WixBundleName] sa vy.aduje s..as. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Naozaj chcete zru.i. oper.ciu?</String>.. <String Id="HelpHeader">Pomocn.k pre in.tal.ciu</String>.. <String Id="HelpText">/passive \| /quiet . zobraz. minim.lne pou..vate.sk. rozhranie bez v.ziev alebo.. nezobraz. .iadne pou..vate.sk. rozhranie ani v.zvy. Predvolene sa.. zobrazuje pou..vate.sk. rozhranie aj v.etky v.zvy...../norestart . zru.. v.etky pokusy o re.tart. Pou..vate

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1053\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	5.1255014007111495
Encrypted:	false
SSDEEP:	48:cxX7DviT8NFLbu9sM2vECjf26axBZYXcqADCNKTbkoN3maT6NWOjEXPauOOKYnhf:8LmTAcRnQXFPK0iHMsfb2Ws3M
MD5:	D95E81164C57B6FD75E7C3022454192E
SHA1:	5D5ACBC56E7078AF4D04C45B78C0FF090C02EE6A
SHA-256:	6DD61CC6B87B53EAF28430068A2A459730FD4B2BCF876CCDF040212D04C4FE7D
SHA-512:	9E4BA81A145574818DD6A1F1D0EC38EA1629C7771919C35923F440E31EA9912E1630D94FCDB82B71104EBD61D0321DCDF935BA20D69988EE6E9B22259186AF0C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sv-se" Language="1053" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-installation</String>.. <String Id="Title">Microsoft .NET Framework kr.vs f.r installation av [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Vill du avbryta?</String>.. <String Id="HelpHeader">Installationshj.lp</String>.. <String Id="HelpText">/passive \| /quiet - visar ett minimalt anv.ndargr.nssnitt utan prompter,.. alternativt inget anv.ndargr.nssnitt och inga prompter. Som standard visas.. anv.ndargr.nssnitt och samtliga prompter...../norestart - hejdar omstart. Som standard visar anv.ndargr.nssnittet en.. prompt f.re omstart.../log log.txt - skapar logg till

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1055\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.2754753523795275
Encrypted:	false
SSDEEP:	48:cxX7DNcYT8anOSMsHEqGpcBztpvrJlrs2ZmNI2+Yo6irN3m22NFcPc+4Trzrdgc7:8LZHTE7APaTI9sq6yEbgg
MD5:	01B200E06BA600A4EF00C00F7AAC5CE4
SHA1:	22234426C42637E069A46217019551E4434A4AB6
SHA-256:	06BFB6DFBC38105C699DEA226A029DF3EF673C33E4B8928DC4EC7FB8F761487D
SHA-512:	8BDCF7533A6BCFA231B42A7EF845A70C7535FBF607D62FF6404928D5941BA6AFBF139450A1A1B58C65FACF88DC0785AEC4ABEFBCC803466A58B1930F7C468CDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="tr-tr" Language="1055" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName] kurulumu i.in Microsoft .NET Framework gerekir</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/passive \| /quiet - komut istemi olmayan olabildi.ince k...k bir UI.. g.r.nt.ler veya komut istemi ve UI g.r.nt.lemez. Varsay.lan olarak UI.. ve t.m komut istemleri g.r.nt.lenir...../norestart - yeniden ba.latma denemelerini engeller. Varsay.lan.. olarak UI yeniden ba.latmadan .nce komut isteyecekt

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1060\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.1485120966265
Encrypted:	false
SSDEEP:	48:cxX7DZ0T8obZsw9g5gS56K97D7NCt2VoN3mQXNJPOhP58vqc1qwueo3RAL:8LyTLlS9h9hCtsihdxOh+NL
MD5:	5836F0C655BDD97093F68AAF69AB2BAB
SHA1:	B6842E816F9E0DCC559A5692E4D26101D10B4B16
SHA-256:	C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
SHA-512:	640A79D6A756E591AD02DDCCC53BC43F855C5148B8CBB5CE6C1CAF5419CA02F7B2AFF89CCA4C056356814D3899EF79BF038B4E8B4B79EB85138A3CEDCCE93E5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sl-si" Language="1060" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Namestitev</String>.. <String Id="Title">Microsoft .NET Framework, potreben za namestitev paketa [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Ali ste prepri.ani, da .elite preklicati?</String>.. <String Id="HelpHeader">Pomo. za namestitev</String>.. <String Id="HelpText">/passive \| /quiet - prika.e minimalni uporabni.ki vmesnik brez pozivov ali ne prika.e.. uporabni.kega vmesnika in pozivov. Privzeto so prikazani uporabni.ki vmesnik in.. vsi pozivi...../norestart - skrije vse mo.nosti za vnovicni zagon. Privzeto uporabni.ki vmesnik.. prika.e poziv pred ponovnim zag

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\2052\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	6.189594519053644
Encrypted:	false
SSDEEP:	48:cxX7DjQT8tOBousi+zq+frUR2ropNV2rfN3msNUqPPT9T+DwZ9f5wDTAV:8L4TGUGw3V8N3RykV
MD5:	A34DCF7771198C779648B89156483E83
SHA1:	A6E0FA91CD50048511C7BEF1BE3A8D32B42B6D1F
SHA-256:	89C559C6765F8D643469E3C8F4AA93023F09369B0395EA647FAD5AF3C2893EB6
SHA-512:	0F1D7BC4FD64E18EEEC488CDCE01FB6BFA5CD3BFF614A8D03E388D39F569B8341E74302946877EB25BA1EB17AEC137499189605E251FAFB6B20051744CB463B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-ch" Language="2052" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] .... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ..... UI .......... UI ... ........... UI ........../norestart - .............. UI ........../log log.txt - .............. %TEMP% ........</String>.. <String Id="HelpCloseButton"

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\2070\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2211
Entropy (8bit):	5.1155097909395035
Encrypted:	false
SSDEEP:	48:cxX7DbT8QGls54nK3znI5zKDj4NLkdoN3mMNYsEPbpK2Aegeu9A5g:8LXTUasJnYdi59som6
MD5:	8A278E519EF81B2847490EFB070219BC
SHA1:	7365EDF6E4F9E66B6CEE47933B6C70FF0B9ECFF8
SHA-256:	E2BFDB2CF3BEAE2E988827C52C58006D7EEAD4ABA5312B5EAE1F6CCF3863C385
SHA-512:	88275C1136FFB15AB04D315E8601BE2DE77387F3E00F17E9807E415A9DFC4A73E2CD3B5710E4CA58006F91E18180D7CFAEEF4E8319C624E1B81397F9CB9ECA92
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-pt" Language="2070" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Configura..o do [WixBundleName]</String>.. <String Id="Title">O Microsoft .NET Framework . necess.rio para a configura..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem a certeza de que pretende cancelar?</String>.. <String Id="HelpHeader">Ajuda da Configura..o</String>.. <String Id="HelpText">/passive \| /quiet - apresenta IU m.nima sem mensagens ou n.o apresenta IU nem.. mensagens. Por predefini..o, s.o apresentadas a IU e todas as mensagens...../norestart - suprimir qualquer tentativa de rein.cio. Por predefini..o, a IU.. avisar. antes de reiniciar.../log log.txt - r

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\3082\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2400
Entropy (8bit):	4.992567587099768
Encrypted:	false
SSDEEP:	48:cxX7DLT8/OusS2V8j4Lq+7dKzCLdqaaD6NJaXFoN3mRNLo3PWKWnRcsB9A8:8LfTz+8EPqKqTJiFikUgk8
MD5:	1024AA88AE01BC7BA797193CC6023375
SHA1:	9252A309C1CB32573F4D58A595A78660FDF54B2F
SHA-256:	B884C4ABB8867553C1FFADD6721C2135EC5F9F1455C3F668D711CCEA65363D1A
SHA-512:	77E6DD332104C0461B7C5A08469161AF3F1DC51D3B55585D39DD9FC9E2088DA036BDF2278CFB96CA702FD26CE073C6C6F66611313270700B9E7A76600C1C8E38
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="es-es" Language="3082" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">La instalaci.n de [WixBundleName] requiere Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="HelpHeader">Ayuda del programa de instalaci.n</String>.. <String Id="HelpText">/passive \| /quiet - muestra una interfaz de usuario m.nima y no realiza.. preguntas, o bien no muestra interfaz de usuario y no realiza preguntas... De manera predeterminada se muestra la interfaz de usuario completa y se.. realizan todas las preguntas necesarias...../norestart - suprime cu

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	487640
Entropy (8bit):	6.164305569969911
Encrypted:	false
SSDEEP:	6144:MjyIhEMMRMRMwr/irwWWx8saRk0taAoaD4p2H2DDhWF2ugJQztU4EDMolZ9C:TILMjwTWWmsGxVoaD4p2H2DAgJuSJZ9C
MD5:	D8CDFE259C09B2DE638EF4A5BF2D4DCE
SHA1:	C06074A1965C2C773E92F85418DCEB2C5FDFEAF0
SHA-256:	5BC6335BC9649AF916A82965E3B55C1B693C216B4FA4D76740F2DB4616E82CD5
SHA-512:	752E99ADF65BC926F2C1AE47ECADF271F788D46CEAB47C525FD8EC97A9388FE8F38564C63896A8D61AABA5652F37703CD234F463BEF58781466AAA2B0AC0B079
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.CrashReporter.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..............!..0..<...........Z... ...`....@.. ....................................`.................................PZ..K....`...............D...,...........Y............................................... ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@....reloc...............B..............@..B.................Z......H.......................\|....O..uY......................................"+.(.{8I...B(....(....(.......:+.(`.e/.(.....:+.(.64Q.(............................8.....(.... ....~~...{E...9....& ....8....8........E........8.............................8.....(.... ....8....8........E....<.......=.......87.....(.... ....8......(.... ....~~...{....9....& ....8......(.... ....~~...{]...:....& ....8......"........................................8........E............8......}.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	907480
Entropy (8bit):	6.2012128600362955
Encrypted:	false
SSDEEP:	12288:DgA3kpCVBwmOzfbi4WZGkc2IClrwDD7bmXX9fyY+:F0fnz3clI7bhv
MD5:	7DF624F2AB3DBE6C5FBCA91F6EA59430
SHA1:	702A5C61AFB3D56C89513E08244359A1B7F4F6E7
SHA-256:	B43544BF5E511B4049289CE847F7710DE6B5EEFB2CF7956CE452FFE53CA0BA7F
SHA-512:	EE38023BDB887D8BE5B18167280126809C3C9230D630C4CDAE8E650AECF8FDE2B6A1DF234FCD5D6CE2EEDE09B504137669C8E0EA06C6AA454A10D6073A3A6558
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Base.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....S'f...........!..0.................. ........@.. ....................... .......?....`.................................`...K........................,........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc..............................@..B........................H.......................`..............................................."+.(9Z.5...B(....(....(.......:+.(..]4.(......(....(............(............................8.....(.... ........8....8........E........Q...+...8......}.... ....~....{....:....& ....8......}.... ....~....{....:....& ....8...............{.............{................................8........E....................%......._...8.........~...(....:.... ....8.... ..d. ....b .#.Ya~....{....a(....

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.Installer.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57048
Entropy (8bit):	6.04206743239607
Encrypted:	false
SSDEEP:	768:l1QqB6K9QpT6vtp+8HfMIZtiHz5wY55bvPQX/fsgM8waDAMxkEo:LQ+6KxEFdwO5DPQXXsgM8w8xU
MD5:	ABD2F4A5CFA8A9608FB14E3FBF44871F
SHA1:	B5249F54A6A73C27BCBBDC07FB6C86D9745BE35F
SHA-256:	06C54E61D243584BE70B1B1CFAA412C99E7C5107DF45BE187A157422EDF9EAA5
SHA-512:	7DCABB779787317C68A6EEB85841CA063FD9D9E3F0A90FF3AFC1FD6FDDC522913528D8E09E46E9430A4B7C1C1CC67347A5CE89F6ADEB1AD262C6CED0C041C1B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A............." ..0.............r.... ........... ....................... ...........`................................. ...O........................,..........8...8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......0D................................................................{...."..}....2. `...(....:.(......(........0............(......,...(....o.........0..w........(....,....i.r...po....,8.r...p.o.........Yo....(.....r...p......%...M....(....+..(..........r;..p......%...(..................\\......:.( .....(......{...."..}.....r...p......%...%...(.....(....o!...o".....o#...*....0..P.......r...p......%...(.....(....o!...o"....o$.....!.r...p......%...%...(....~%....

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	636632
Entropy (8bit):	6.066203134927089
Encrypted:	false
SSDEEP:	6144:vzWO85zREXbv5vDcTMYw39udKMnK6ZtW6X/FffN4CoOwmmNy3tfda9becmlIlF0l:CTzhKNSfOOwKjcVp1p3Q
MD5:	EC3D9350A9A400FB3271C7327F5BF5A8
SHA1:	0EEA26F71E7D03579303B9FFC34549FA7AC843E9
SHA-256:	AA43B82246DE237CC9898D6EC2B18BCAFE3A1BAFBADA9FB7939359866D2909E4
SHA-512:	A789B3056303EE8680ACA458C01C947DBA6C33C14966A65EE27B338CAB2C25FB6481435063814BE81760BED25D385F4313149F5F4792620660CF6252A2E0C01E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.UI.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~.e...........!..0.................. ........@.. ..............................';....`.....................................K........................,........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@....reloc..............................@..B........................H.......................L.............................................."+.(z.ib...B(Z...(P...(.......:+.(..49.(.............{................................8........E........K.......8..... 9!). ....a~....{....a(....~....(.... ....~....{....:....& ....8......}.... ....~....{Y...9....& ....8~...............................8........E............8....* .x.l .X.ua~....{....a(..........%..o.....~....(.... ....~....{....9....& ....8.........*...............^...8.....(....

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1857240
Entropy (8bit):	6.111193707728407
Encrypted:	false
SSDEEP:	24576:IYMr/wYqFeVAiLdogUdNO8nH2OE+vAH2QBqnftgUs4SV0dXJX:GueVrLdogUdNOCHr5HlgZV0jX
MD5:	5078EDDD8DC8D0D328D7EECEB459929B
SHA1:	60F4A74DBC5F4AF10526198A5A43E09F84B54C98
SHA-256:	C63CE2079D0EE96BA13CBBA30B6CF4C7EF42720815E82D8EAC2526ADBF881F40
SHA-512:	B09B7FBDCC899BFE27F76080D95B3882875A5F53FAEC52C97418554E38373327088B750581C85FB6D66D19D3C1CCCFF6F313FCF73519B48D6B32F260A7F3A84C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Utils.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....U............!..0.. ..........>>... ...@....@.. ...................................`..................................=..K....@..t...............,...`.......=............................................... ............... ..H............text...D.... ... .................. ..`.rsrc...t....@......."..............@....reloc.......`.......(..............@..B................ >......H.......,...Tu...........A.......=......................................"+.(.{i...B(....(....(.......:+.(}.&l.(.....:+.(0.wL.(.............{.............{.........................}......}.................................8........E........!...........Y...3...8z...(.....{......{....o.........;.... ....8....(.....{......{....o....9.... ....8......:.... ....~....{....:o...& ....8d...8.... ....~....{....9K...& ....8@....u...... ....~....{....9$...& ....8...........

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	392408
Entropy (8bit):	6.030957500184647
Encrypted:	false
SSDEEP:	6144:ykiME4ik32wVgWe2ZSi2zQG8PR/BOxbDU8RJ0lu:yq+noHe2czf652bI8fIu
MD5:	0FC409AE184FEFB12DC266ED5F0A3862
SHA1:	9EAA83402A9C2E7DECE73114FA780BC8C65572A1
SHA-256:	43913461ECEB87C5D7B45E3449851EE4F66AF8CDAFCC9DB3C2874C2CB861AB65
SHA-512:	6DD3E463AAF27CD62F1FA066344CEAC23D6AF2B84CB0FFC3C23F44B752D126641C00354F20A66C76E81109AE39DA817B82E408D203102D1B33B83FB4BB9014CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.Common.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ro&f...........!..0.................. ........@.. .......................@......ce....`.................................`...K........................,... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc....... ......................@..B........................H............i.........................................................."+.(..\|h...B(....(....(.......:+.(+-!i.(.....:+.(.XpG.(...........................}......}......}.......}.....(..................................8........E........]...J...4...+...........8......:Q... ....~C...{T...9....& ....8......s....z..{....9.... ....8.....{.......8v...8p....8.... ....~C...{S...:h...& ....8]... ..c. .i.ma~C...{....a(...... ....86...8.... ....~C...{=...:....& ....8....... ....~

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1522904
Entropy (8bit):	5.938731880648518
Encrypted:	false
SSDEEP:	12288:aPbPATspyDCvDg0OGujH5CGOt3+llYpeUcUlVpAb/xHwd9+GaHnK+PUYNToczPkp:ajSCvcFGkCW72NMOiTH7lWNfnMfQqJY
MD5:	E8B18DF3EF0D16DAAB0B0C8A4D79E399
SHA1:	8AF84E066266BBF5226BC4BE7E7933FD76DA9C9F
SHA-256:	EA32A09C257867BE8527E9F64DD2B19502992E913436D18C37376F92AC74333A
SHA-512:	6316FBAEC1800304719BFB8FB3C87CD865E6024A40A783FE9396E4A10BCB5A634EBAF9225393B4F20B9D4E4CD224349659987844555046CD6413728E10D89823
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuard.Vpn.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...So&f...........!..0.............^$... ...@....@.. ....................................`..................................$..K....@...................,...`.......#............................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@....reloc.......`......................@..B................@$......H...........4................G..I#......................................"+.(u.dd...B(....(....(.......:+.(.9f.(.....:+.(.KhC.(................................8........E........)...P...8....8F... ....~....{\|...:....& ....8.....~...... ....~....{h...:....& ....8..........0..........(.... ........8........E......../.......F.......8....*(.... ....8............%. ..@. ...jY WL..a~....{`...a(.....%. 5..p .Q?Aa~....{z...a(.....%. gk@. ....b 5.=.a~....{....a(.....%. .m.O ....X

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	261632
Entropy (8bit):	5.279521785173736
Encrypted:	false
SSDEEP:	3072:x3y0+6GObAXHZLmIpKVcKl7oc3jo5bh1:xC0xpbA3N8hl7oc3jo5b
MD5:	DEE30F3E6BA778C751F2F60FB4670478
SHA1:	498124DA412A7A4D8BB6B78228F800B583262100
SHA-256:	44C456F809E765A91C4527B55591301EAF74260D92FDD786F3E4053B700B2864
SHA-512:	F8F3928AACE5E6FB593966AC6D2ED113598C37A0B767CBE4EDA7D9F53E3E612BCF4642FFE3BF1432FD564716C1F4A02F72D8E6D0279D6262593B1F9FDCA19A04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.9..........." ..0.............2.... ... ....... .......................`............`.....................................O.... .......................@..........8............................................ ............... ..H............text...H.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pX..............d...............................................>. 4......(....2......o....:........o.....0..,........o....r...p $...........%...%....o....t....&...o......(.....~............~.....r!..pV(....o....rC..po.....rK..p.(3....(4....r...p.r...p.r#..p.(8....(........0..b.......rq..p......( ...(!....("...-..-..(H...r...p(.......(#...&r...p......%...^....( ....,..(.....($......0..........r1..p......( ...r...prg..p~%...(...+..('...,.r}..p......

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.Burn.dll.config

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	656
Entropy (8bit):	4.964696021977938
Encrypted:	false
SSDEEP:	12:MMHdn9nF3F7yA5v5OXrSl2/uo+/toA5ceeycl2/kr/tOixj:JdnxNF7yYhOXrSl2/uo+/toYJUl2/krj
MD5:	F3B06257FAE705165146B020D3053745
SHA1:	2EC73BF60269CDCCE621B44297B7EDCD126EB4D4
SHA-256:	B005A38601A8027DC44688FF52C52E98DB2FD49721CBF3A1876828CF8350E2CB
SHA-512:	9660BAD0671B0EA7B02524A68C9382FA3CC7DBF54BCC63822DFCEC7BA47B2393E5207126023FA7979ACB084358819C93BBCD4087CA00ABAFA44353E785DE5A74
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<configuration>. <runtime>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0" />. </dependentAssembly>. <dependentAssembly>. <assemblyIdentity name="AdGuard.Utils" publicKeyToken="cc321ba03e90d705" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-2.4.0.0" newVersion="2.4.0.0" />. </dependentAssembly>. </assemblyBinding>. </runtime>.</configuration>.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\AdGuardVpn.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6411992
Entropy (8bit):	6.750783795781533
Encrypted:	false
SSDEEP:	98304:+esgE8FWJVPzlAJIDyM9EM8ZeykW4yr7sCklgxNLllI+pe4:qglwzlAJIDyM9EM84xW4y/sC1LUR4
MD5:	D1A5895B27AB2B99D91FAA998D23B58E
SHA1:	407CAED4FBD0D9EA1646FF0AFEDC11334F39B3AD
SHA-256:	364531A0A4C65B2132398B1A9085CF3ADE18CF9315795F4792FFDC2DDBB4E4A8
SHA-512:	2557F86BF58BFBECAF583819740095E0B2A3BD7DAD1E11F11D21C542C5547C7EBA08D55ECC4580E11E65125B88212F504C3E8AA9BD44A32FA6160A12573F3190
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........u.l.&.l.&.l.&B..'.l.&B..'Ml.&5..&.l.&5..'.l.&5..'.l.&5..'.l.&.l.&.l.&B..'.l.&...'.m.&B..'.l.&.l.&.m.&...'.l.&...'.l.&...'.l.&...'.l.&...&.l.&.lz&.l.&...'.l.&Rich.l.&........................PE..L...>o&f...........!...$.RG..RC.....i.C......pG......................................Qb...@..........................].......].........0.............a..,.......A....\.T.....................\.....P.\.@............pG..............................text....QG......RG................. ..`.rdata...t...pG..v...VG.............@..@.data....~*...].......].............@....detourc.....p.......N_.............@..@.detourd.............`_.............@....rsrc...0............b_.............@..@.reloc...A.......B...h_.............@..B........................................................................................................................................................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (450), with CRLF line terminators
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	3.789889000212775
Encrypted:	false
SSDEEP:	96:XQdn6d0dUIychfn6JWaFU0yc5n68AN0woycwvUk4ve8Xr+sqLt:XeOnYfaeuvLIL/gbi
MD5:	F915AC2A7264034E779F60DB535DA9F1
SHA1:	39689D2B2380D442EAAFC298D610CEC4995EB7DB
SHA-256:	A97F6C2FA7F994E0F50219F5D554FABA9F42FD15322BB8788B78F76423BC9ADA
SHA-512:	F971CB0F0CE628CEC8955F27A73D9C80F3627A90BEB07BC0382B02848A1C4138D7E15B1DDE021B861063D3921938163B4411C327F0FA1D5A47C30B99449F6CFE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".A.d.G.u.a.r.d.V.P.N.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.d.0.b.2.1.d.a.6.-.a.4.b.1.-.4.4.9.b.-.9.4.0.8.-.4.b.3.d.f.d.7.3.2.1.5.c.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.E.C.8.B.6.D.7.6.-.8.E.5.1.-.4.B.E.B.-.9.6.0.2.-.7.1.8.B.E.7.8.E.B.0.5.8.}.". .P.e.r.M.a.c.h.i.n.e.=.".y.e.s.". ./.>..... . .<.W.i.x.M.b.a.P.r.e.r.e.q.I.n.f.o.r.m.a.t.i.o.n. .P.a.c.k.a.g.e.I.d.=.".N.e.t.F.x.4.5.R.e.d.i.s.t.". .L.i.c.e.n.s.e.U.r.l.=.".h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.D.=.2.6.0.8.6.7.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.config

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.014979412561275
Encrypted:	false
SSDEEP:	24:2dRt7RtYr49itYQsKmhDrdHDxshqRQNF7yYhOXrSl2/uo+/tO2:cfRt0Kit0vlrh5QD7e71uo47
MD5:	427918825375CE8AA01F208629C901FA
SHA1:	BB983D3B30454DEB48695E495B8483195D72C927
SHA-256:	EEE85D8D43E427F87E043F9516BC2511C891980A134EBA7E2D6097438EF860E4
SHA-512:	1368FB726B21D96278773E37FF36B20952578C814F7E4D3EF76CC81A5B2D608F04E65C1E6328F19AA59F40DD2701D6F5AFA167CDE14143D385CD075A8359B4CF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<configuration>. <configSections>. <sectionGroup name="wix.bootstrapper" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.BootstrapperSectionGroup, BootstrapperCore">. <section name="host" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.HostSection, BootstrapperCore" />. </sectionGroup>. </configSections>. <startup useLegacyV2RuntimeActivationPolicy="true">. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />. </startup>. <wix.bootstrapper>. <host assemblyName="AdGuardVpn.Burn">. <supportedFramework version="v4\Full" />. <supportedFramework version="v4\Client" />. </host>. </wix.bootstrapper>. <runtime>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0" />. </d

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\BootstrapperCore.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90032
Entropy (8bit):	5.688550211341784
Encrypted:	false
SSDEEP:	768:9BgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ1ErEgtCmYjhm:HHMBp/GRbgi5ofpiG2pq+51EogsmYI
MD5:	B0D10A2A622A322788780E7A3CBB85F3
SHA1:	04D90B16FA7B47A545C1133D5C0CA9E490F54633
SHA-256:	F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426
SHA-512:	62B0AA09234067E67969C5F785736D92CD7907F1F680A07F6B44A1CAF43BFEB2DF96F29034016F3345C4580C6C9BC1B04BEA932D06E53621DA4FCF7B8C0A489F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Mp.].........." ..0...... ........... ...@....... ..............................N.....@.................................`...O....@...............@.......`......(-............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Google.Protobuf.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	410952
Entropy (8bit):	6.098784833091384
Encrypted:	false
SSDEEP:	6144:KwDm4/Ib3J5SSPHGFVtwb/0V0qnPEEVwoVTqcQc+QZyiu69hOKbBfM0gF2:Kw6oCrSSPHlbmMEzTqsFO+
MD5:	A93C82719E98C382D81BC0DCD99AD402
SHA1:	8814B631FD15C35E737DB42BC908791302496A83
SHA-256:	6E5DB014AE75B455A97F7F161507AE1058F489333126F30607E6E534D3DDEA82
SHA-512:	60D897EF434BDA51921E111A39B50B4E2B832C8DC3A8444A4B36A2A9D898EA200D990EA2EDFAB02689B4C1A03D1CB9110428727DAC13D70318B850D4289529F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.$..........." ..0............../... ...@....... ...............................d....`................................../..O....@..................H)...`..........T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......xW......................L.........................................(E.....(E...:.(E.....}......{....:.(E.....}......{......{...."..}....V.(E.....}......}......{......{......{...."..}......{...."..}......{...."..}......{...."..}........0../...........1.......(F......X...+...%.X........X...2...0..%...........i.Y.+.................X...Y...2...s....F.(...+(H...(....:.(I.....}.....~....2.\|....(J...*.(.......2.\|....(K.....{....2.\|....(L...*..0..

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	662528
Entropy (8bit):	5.91790849905593
Encrypted:	false
SSDEEP:	6144:3o4V9ynqKoxhi0gAsfLBhJJzhGIVrdhoHuLFGAJmKApt5psaLGBFahKGRd67XLEm:LyncxQRhJJzhoqgH5sB4dxHG
MD5:	5AFDA7C7D4F7085E744C2E7599279DB3
SHA1:	3A833EB7C6BE203F16799D7B7CCD8B8C9D439261
SHA-256:	F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
SHA-512:	7CBBBEF742F56AF80F1012D7DA86FE5375AC05813045756FB45D0691C36EF13C069361457500BA4200157D5EE7922FD118BF4C0635E5192E3F8C6183FD580944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u.3..........." ..0............../... ...@....... ....................................`.....................................O....@..T....................`.......-..8............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B........................H........t......................x-........................................(......(......{...."..}......(&...:.(&.....}...."..('.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(...*.0...........{)......(....-.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\SharpRaven.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117080
Entropy (8bit):	6.406215603644869
Encrypted:	false
SSDEEP:	1536:WKKw4TfSgLOwanNdGzV9P23rl0LnITwa8yNpgwoIhAm7lPxHPxS:WKKBrbanrp0k38yNumrZxvxS
MD5:	89A2762F19597B82D5C501366E5B2F29
SHA1:	F5DF7962015164E4BFED0AE361F988C1E581677E
SHA-256:	A236377DB9EE299087C4F8FA6E345765AC4A25AA5D7FABFD8B724F1889324167
SHA-512:	BD2A4AB78835092ABB0CF3CAE0850C8B2AA344247F6479CFD59D52BBA60C4B605ADA4BF885E1AB0B86D4FAB138A9084900B954E62E6384D794F2CE61C999CB13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~..........." ..0..x..........N.... ........... ...............................I....`.....................................O.......................XI..........8...T............................................ ............... ..H............text...\|v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B................/.......H.......,................................................................0............r...p( ...t;....+.....0...........~.....+..".(!....Vr...p("...u............0..T........(#......(......,.r...ps$...z....s%...}......{....(....}......{....(....%-.&r...pr...ps&...z}......{....o'...}......{....(....}......{....(....}....rQ..p......%..{....o(....%..{....o)....%..(.....q....%..(.....%..(.....(......s%...}....r...p......%..{....o(....%..{....o)....%..(.....q....%..(.....(...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Data.SQLite.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	5.986532957924007
Encrypted:	false
SSDEEP:	6144:o4xtlRVuJ4v4pFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cb2:Vljdv4pFNFaFeFOFwcGF6cmFWc0FWc81
MD5:	AE8E6840BCFCE9AB0F6DB77A5F60CA1A
SHA1:	0981E864217C2EC5C67CED185458010E4BEDAC6F
SHA-256:	DAFA4A7E1186E5FE8223317F654795B9142D72917006EDAD03EE3D1DE5162BC6
SHA-512:	B3C3EA043CC8A286C9B7684FA7402534E2AB61D3EA9605CBF65EF88E1AF13A2EFA4E4911C2BFC1518B33A315D098E72CEBC04F8B47967ADF6CFFA2AD7765F5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I..Y...........!.....<..........^[... ...`....... ..............................7.....`..................................[..W....`.. ............................Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc... ....`.......>..............@..@.reloc...............D..............@..B................@[......H...........8...................P ......................................1.9v'.J..b.r.4.t...,9.p\|.A.....a.....tl..........i\z9......Q.uo.x...O...a.#..I........h.#.\.3f._QA8No....YR..J.S.w..O. ..1:.(......}......{....:.(......}......{....r.(......}......}......}......0..5........-..~.....o.....X...r....~.......o......o .........6..(....(...."..(.....0..T........~!...("...-..-.~#...../....+...X....($...-..-.~#.....r........(%...~.......o&...Z.~....2..~.........

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33256
Entropy (8bit):	6.470050941710262
Encrypted:	false
SSDEEP:	768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
MD5:	82DEB78891F430007E871A35CE28FAC4
SHA1:	4E490D7EC139A6CDE53E3932D3122A48AA379904
SHA-256:	2F141B72A2AF0458993E27559395D8A8CDB0B752D79B1703541A61E728B55237
SHA-512:	E47F741AA9153CFAFC5F6BE39987D7C7D8FB745566C4D9A4525B9F30CBE6DF450D27BCDF8998DEC7AF824A7BE0F5E9EECAD2A39072B956A6320D23D94A0DA71A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ub.X.........." ..0..8...........W... ...`....... ....................................@.................................dW..O....`...............B...?..........,V............................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................W......H.......4%..p/...........T.......U......................................r~....-.(....s.........~.......0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(...........%...(.....(....,.r...p......%...%...%...(...........%...%...(......0..A.......(....,!r...p......%...%...%...%...(...........%...%...%...(....2r...p.(..........(....2(.....(....^~....-.(.........~....*..0..........~..........(

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ar\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.858496069739486
Encrypted:	false
SSDEEP:	192:vFWrO1dE0+KrkUW1KKrjQl1U4US75iCW5JU6:vFddE0nkUW1KKrMIZS75rWn
MD5:	EF6029B7D20E51BAEA1943A77C3DC2B4
SHA1:	70D3DDF1E97984C3C3A350937259550A1BDE982F
SHA-256:	4E49EBADB49101CFB5DD43670963CDF83E321817EDD3E30196B920DDB72772AA
SHA-512:	5F6A16FF467E02C180F6071CF9DADE21B73DC21669149615EBE4085ED6CA6C506AAD33D76A2F06AF5DF88D066C0CDDE5DCF91CDC51EC867864D9F679EBC22083
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.Cf...........!.....,...........J... ...`....... ....................................@.................................hJ..S....`............................................................................... ............... ..H............text....*... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......lF..............P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\be\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.772933178977623
Encrypted:	false
SSDEEP:	192:AJDDr3NDR1ANbb/UmTPM1gzh5fm4qT7w6:AdrNsN3/ZTNfqTP
MD5:	DD199D4D28BE1867F703436CF7941ACF
SHA1:	DBD8480E1AD0EFD8A935141B5D6A902CCBEEFD21
SHA-256:	11DED66BBBABED71A3E12438DB4A943CB2D33101BFBECD4C0DDE848784640719
SHA-512:	F56B26A82EFF4DB5BFA3F8275586A2EA8DF05A5B5CA448C17E9110A257417195F073E1A7E6405EA2CE46FB57301A7B9C606C93FBC2471AE855581DEE7B399578
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!....."..........N@... ...`....... ....................................@..................................?..S....`............................................................................... ............... ..H............text...T ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0@......H........;..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....7.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\..b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..GO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'.m..it..t".\|...\| ..}....'...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\bg\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.354608335089476
Encrypted:	false
SSDEEP:	48:6HzCHsX9s3KewzhdUGUzj8LOGuGsL/3z2lGVjq+bca1o0lC6GL3QUaNF0wEyGwLV:+CiXUGUzjkOGR+/D2leWOo0lC6J6
MD5:	388CC468547A4057D6EE40F8C9B20620
SHA1:	8BD5B3EA5F70D8167CB73C077873D6196008F2EE
SHA-256:	768EDAA425C334DBBEF0AC7471C988AA11F86EBC73DAA7402E8EA61967DD7C1C
SHA-512:	578604284F1151C8A7CA951DAE5BEAAE5E80A190EFA768CDD07F8A7E86C09E3B965F1B2EBD837721AAD198BF8DFECB3F26AEFFAC87FE6A9F321367415296A073
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!................^/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@/......H........+..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........u.j....;..\...9....#.............k......F. ..:3M.(DO.6Q.i4X..]9Y.`.S.l.[.m..t".\| ..}\...............`...............i.......s...'.../.......R.......................5...T.......f............C.a.n.c.e.l.....<C.l.o.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\cs\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.764379673113224
Encrypted:	false
SSDEEP:	192:jFWryOaWd4rTLsglVXlpQd3Rl527a4XRLVWp6:jF/ZFrTQglV4dhliBRLVr
MD5:	6C569A5D39B41AC467E818AE3BA431F5
SHA1:	036F7538892B1D1EC0E49E43A7638D9A5459D064
SHA-256:	2D7E936AE8D23CF03A1930C4618E73E35696BD25696727A7C08D2D4AF21611B8
SHA-512:	123FCB2A2C35183FE9BE50586599743002D334FCFF94321197063FFBBFEF6827E87A6020C865E811CA78A66067CDE92E99DD25F11BAE39AEB101C9EE9C2FD587
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.....&...........E... ...`....... ....................................@.................................DE..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......HA..............P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\da\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.507253055140553
Encrypted:	false
SSDEEP:	96:qlgSDCrKn6rwrmwYf3qKUfXyZA3hyMjw0U1TgSxyRFdZRHI6/Q9F4CIKy7D3usRY:AFWr7EmwPpU9u8yesRJG8hH3s/RG6
MD5:	F24693D9ECB428A17990EC764C804A25
SHA1:	343066209B5E3A0F9CBCB640FC35DB5A4C5E319B
SHA-256:	4F70D98AE9D40F0B6E3F1F044F815343AEF44CDFAE3BF27AFF77E3A1B953298E
SHA-512:	ACFB18707010D69E119A0A0F690F7352FC5BDB2AEF61C9560E92259E0E12CC6706BB8DBC2C155AC5E7DDE06E99B01E6494DF4714B79F64DDB8B493D982CD3E9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.....&..........nD... ...`....... ....................................@................................. D..K....`............................................................................... ............... ..H............text...t$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PD......H.......$@..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\de\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.576984355325907
Encrypted:	false
SSDEEP:	192:5CFWry2KjE2u/FAxjqFIDua8x2Zl7vMeQy26x5E7k946:5CF/jjE2uCPE7+
MD5:	A34E874D7CFFD93CE22FA204A6DF27FA
SHA1:	A34E21425A83F872FCE9604B0FC06DF96BDFE7DF
SHA-256:	09472CFBE0C0BC0E79FE451142974300D9E9B5142EF945FC8218E33BC636B7CE
SHA-512:	3EFE1DE8B55067D0250FB813B63456941AFF1E50C3ABF5611AF7920311F218A447FEFC198F9A4259412209CB2DB702E791F905979CAF5A692C4A94CADF355FCD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!................H... ...`....... ....................................@.................................LH..O....`............................................................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......PD..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\es\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.514356574250874
Encrypted:	false
SSDEEP:	96:WgSDCrKnsKJtKDZHc4mNVTCGWjFx0++ibyQXCRUD5Rg+eRk33Q8JC7301Z/g7LX2:WFWr2tKDWtWHKE1Z4Ei7a06
MD5:	FF5526260DA420C6C12B67FE62793B22
SHA1:	50C6644E3AE249519024E9100F1FC09103351A0E
SHA-256:	1A157118AA7D7D4526A8B3A07F8AF63A861630CD6E003D3AE6B86B648ADA216D
SHA-512:	21DCF66A7E81AB4B3B3CDC0E789AECD49D0957E315942044AAC54D2CD0819247A5DF3D9085E17488A5C38A8D0F8A8B82DD0D70F6FAEB4E33D288C5A650E986E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.....(..........>F... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...D&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................ F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fa\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.14844069796407
Encrypted:	false
SSDEEP:	96:+GqReSvKGjBo+r7Rxc2naDt9DF0lC6k6:Z6ea6JWa6
MD5:	7B95A4517F28C7117AF6B5BE639E6B42
SHA1:	A83AA9B3B82796079F6C4F868E08E1C47FD9B772
SHA-256:	BDE8B97D808FA67F7412330D19E8F79428B72C4823E78AED6D5A845658E3C4E4
SHA-512:	DE02FC2E21FCBDE6961B9545017C6C06BB2A28E2C73E01335B5892D0D3D1B3CB830903D4E54700B221AE80BC40D8032ACA0586B75DE1135ADDAD590F093A8D0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.................0... ...@....... ....................................@................................../..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H........+..............P ..i...........................................e..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....../....u..;...9...7...#......... x...n..d......k......F. ..:3M.(DO.6Q.i4X..]9Y.`.G<c.0.c...j.S.l.[.m..t".\| ..}....P...x.......................x...e.......k.......................a...Q...........J...................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\fr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.622514818117589
Encrypted:	false
SSDEEP:	96:wUgSDCrKn1YZ3ranOJA9TAGnJIjQhtFqIaFyGBARBo82YZ1fdJjR1DT48+KjrAil:NFWrv3CNlPfXjXDEjKjb0R6M6
MD5:	760B1D3F776AE9A6F85E8D11B3F7ABAD
SHA1:	425C42A4C163A52E98B2F04FBCEB108EBF55038B
SHA-256:	C9E204AB98A72E681E78E221BDBCF4FDAB30D6A377819EF2C87E00CBAE5D7B06
SHA-512:	2C0DFB1D67B4D28F4886A44ADEEBC53D6E39217811CEBBA1D23842AA5AD32B9269B295FC2B50D954763D17E5A64D1831E49CE0FCC5B436D4EFB8BE2BABA83D40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.....(...........G... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H........B..............P ..q"..........................................m".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\he\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.596847872672188
Encrypted:	false
SSDEEP:	96:w1zMfqLXuAJTptO1zkjQHtIjZMronyMwRBQDKqNTt04uLV8A92jqb5vZ3+0lC6QG:8zn1ptuuTt/A9P9vZ3nC6
MD5:	3CA2183DE404836DD8FF71FA71683D18
SHA1:	5DB1F56052FAD084C80FE0A3A84A5C3C0EF091C6
SHA-256:	F9CA78CF49C9C575F26174B1C37745DAA53B60B8B22EFC7A31895BA67ECA7772
SHA-512:	93423F44640DE3B144ACBD478923F45303889C4E8381685D8B28D9870BDE10C8BF3D6C421BCC1F08B1CEA309F8C4B7580F2CF9F4DC0FCCCA70935B45FF145C6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!................^=... ...@....... ....................................@..................................=..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................@=......H........9..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....8.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d......k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}o...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.537044927253244
Encrypted:	false
SSDEEP:	96:wlhBUgrdJNxp5TkVe/nY9mjenCnUBbyLHRQ+dyJThhdBTRs2THhXCfQknQ9YvtfO:ghBUwNxbcJ1hf6QE0YtdjdD6
MD5:	A77338FC46EB081D377B54A2D4D58568
SHA1:	3F57ABA7BCE46D7B0E1218AABE7DB83D89BD8530
SHA-256:	772AB1466FA9C2B250A507E972DFEEBA8B212A0F58148994629A6A5E5211AB1B
SHA-512:	217FB89445370B359A402D441567452C0480E797BF0E92EDAAC1CC9C5F85F34B44F98933AC645716A912F7A292D9677E85CE55EE1DE72EE7A8217ED8498C7716
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.................;... ...@....... ....................................@.................................d;..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h7..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hu\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.561596673863613
Encrypted:	false
SSDEEP:	96:w+BUgr2b4SPKBIEV/Yy9jygjgqyo1RB5Ta6Mi0AHkxnteOicDiE/a1n3E0lC6QF6:zBUN4SGf4JteO161n3J86
MD5:	D839579A18BD67BB3D6067D40B8BECAA
SHA1:	405091A2BF3D6822C97C92F1FEF2A58A243129AB
SHA-256:	BF1D0CC3C3371D03004EFD7B24B77A2026CC7C602E1075981F3112D94C6EC5B9
SHA-512:	AB066FD0F13176C01746040F22DF5566993B90222E92A2DEE53A49368C9946DE6FBC6053A7101F2B496E42C81429DAF0E036A1D00EBEC0B4ACC8DAFA0ECD2599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.................<... ...@....... ....................................@.................................`<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......d8..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\hy\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.129446179243231
Encrypted:	false
SSDEEP:	96:worqj1c+hkaHQjb5+KR2lqZWn10lC6Qb6:ZA+vtKq4nGC6
MD5:	EFBC7D9A72EFDEAD7F3295AB8373A363
SHA1:	68C5901FA22465A6C16AFD6BA343BA187B37E2C8
SHA-256:	98A99D707E4FD8D33A7FCAE42952B35B736CA5F960CB5B8841ECB66BE224C848
SHA-512:	377D7A82745B3E3B4C9356FD39F6C2E12AC718BB19A1B66DA6150927462855A62B0C5D160E85CAF8D2A5835DBF31E9DC705197D91AA3D8AECF2BDE0293C9EB0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!..................... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H........)..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........u.j....;..\...9....#.............k......F. M.(D.i4X..]9Y.`.[.m..t".\| ..}....................]...........R...{.......................T...S...*........................C.a.n.c.e.l.....<C.l.o.s.e.A.p.p.l.i.c.a.t.i.o.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\id\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.378579357988375
Encrypted:	false
SSDEEP:	96:wlVTybtPdK35lWTy1IHJmjBUJtPyrBRqrTrMimTvq52p+4xMR1oqjL4eDf0lC6K6:GVTybDK3tUxqi52p+4xMR1oOL4eD8Q6
MD5:	B418208DB33E48A09F34F7EEFDF3DF16
SHA1:	04DE3B5AB03EC818165C9F238B9B12FA95734177
SHA-256:	C87E3E7C6F5B2814BF3506B97AF31252B92A153E826EC4E2A461913437DA682A
SHA-512:	6309A9261E1BBCF69BB56239520A3C29ACD5B9C9E3562D64FCBFD958963764A5749FBCB5DB6A6475ED306426F2A1CD0A01E5EC725179E320D0C6DCB5BD4369AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.................:... ...@....... ....................................@..................................:..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H........6..............P .._...........................................[..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....8.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..GO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}5...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\it\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.542393470126645
Encrypted:	false
SSDEEP:	192:1FWrQeKoFoM9MUbR0EmOXzBz5sgcTmgB386:1FAK6o7UbR0EXzqVBv
MD5:	6E0451823B2B83A7B0FC273A96A05CDF
SHA1:	344927B8BE14513059E0ECED8F5CCA710E7A4639
SHA-256:	59443A62231EBDBF28C3A6CFD903E369161CBCBB363795E88A23AC5F42D42899
SHA-512:	3E6FB6A56641A0B83445D9211B4092F79357CF2DC24F6C447254006DB328FC4916435035A52EE899B0C95D16184C362873DE7CEFFC03E6B9943CB3C397CE4CAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.....(...........F... ...`....... ....................................@.................................dF..W....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H.......hB..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ja\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.1435311694632535
Encrypted:	false
SSDEEP:	192:dFWrzw/X2XwshtFMgZIioP/s2YVyNXEbyh7SpTw6:dFb/X2Xm2lVQXk3
MD5:	68A26FA5D87BB7B92B17B0810C765C4D
SHA1:	9A81FED55F0DAC2E9BAD73F78E9826DDDEF0D20E
SHA-256:	A48E2E4622C36B3AB685A548B9B4D61BAC866A960B9AC2057765C97F38259D22
SHA-512:	11E7BAB888F5C3590BD254F0EC9451752CB343D7AC9111658BCC627B81D281E3D457DE48E93E90823117F5B4B311F72BA92302C6AA584608EA31750EDACE61D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.................L... ...`....... ....................................@..................................L..K....`............................................................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................L......H........H..............P ..c(.........................................._(.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ko\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.074458214104735
Encrypted:	false
SSDEEP:	192:mFWr9YAjE2TCDZ1taSA22BJzyIJ6xylXfXq6:mFNAA2TGDaSARpJMiXx
MD5:	8717FFC7ACE50175EB4350748FEA0EE5
SHA1:	0E797A1C1419672166DCA7B8B1AC033ACE6FA165
SHA-256:	4B167E9562269D493DEEE71857F0456A4A5E572F0316E93D798598E7B1B11113
SHA-512:	E44E9C5FA2F805526C15F05C89DBFEAFE674C8DAFEF047CCD3786B20418607AA4D939091C3BA48CA027DC0656CA03B6A84C18D81C5EF071F6B9B0CFFCB77B1FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!................H... ...`....... ....................................@..................................G..S....`............................................................................... ............... ..H............text...$(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H........C..............P ..z#..........................................v#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.070412664469304
Encrypted:	false
SSDEEP:	48:6VskHQHlXONEo01G8+UPU9XCHA7ke6k6WDAR7Z0lEsRPJ1Se6Bffs90w63XT8wfI:zk2V0l9ygg/kpOelE43mffW
MD5:	42E4C8538BDBDAF9E6EEA04170A30ECE
SHA1:	7E1618E919940D628A129701DB72E5FBB0A0759B
SHA-256:	C7F9B280C936628D6862B4058B76904ACB5203B04BB0DB055AEA8087F467C443
SHA-512:	A1D901E283EE40BF502C5D4BA32799739F8E959AD10D4696E0049253390BA0C8AAEE3E3E902E2AB3C680E21EF047BFEEDE4993F9AA0528783AB1D100AE5BE3D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..f...........!.................... ...@....... ....................................@....................................W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ..........................................T}.....j......j-)....4V.3.k@6.P.VX7.u......4..7..yV.\|.....vG.dS.....'.hsU.<..#..UM....'.......e..JN....?Y%........l...'..)...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.da.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.93118173589459
Encrypted:	false
SSDEEP:	48:6EPoGxqzHQHlXONELRqt8Hu49Xl0AGk4dKHb0a2xfqo1/Z0lEsRPG1Se6Bfns90O:BoGxg2j4W91bdbH4p5FwlE4umfnW
MD5:	E24B481325CB69CF39B7817E776DBAC5
SHA1:	949D8447D6FB2422DA8B6014BF215C8180493705
SHA-256:	86A8E278CD0F2EA64D16D55E183452D9325E4AF8F83F7A64C8F52741B3BA011D
SHA-512:	DE89364DCEB6F023FA837F428E3006F21D7A969A640E0461028CF2AF97E25B97F24F0EC8686C3BF4C02725230AB0FB278CF4DCDA3363EB889FB4A1E2D74B3588
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..f...........!.................... ...@....... ...................................@.................................\..O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......l&............... ......P ...............................................5:..).....r ...x.......O.Z"l4.#!..4C...r.R........m.OX.5.."p..&:..Fl..GV./..T)v.L1Jp...25.....h.3i4`s..7t)...x...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.de.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.068406925189331
Encrypted:	false
SSDEEP:	48:60geIHQHlXVN+cGuPI8otc+HW9XYYAVcDlYw8K3wZ0lEsRPaF1Se6Bfws90w63XO:VI2MughBW9IXElYFWHlE4y7mfwW
MD5:	8463D83E3DD30F47D7F5FB3BB334B40C
SHA1:	5FED0096E8870E8CB6F85117BAF879DBDF0B4C3A
SHA-256:	C11CC9512EAA3F08BCDD203ED76C38EAFC5B099301CF0735695C9495A6C134F3
SHA-512:	FE080390E65452A9F7957B3DA9E73167F7BB2EA71BE98870BBA72F16D85F1604CE082CDEE64186DB2D7BF8A6C74EEA17782ADDFD8D8FA5EFF2702BDA0DFADF32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..f...........!.................+... ...@....... ...............................t....@....................................S....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ............................................E.M....=&...u..q.F.}6....../..=.....q.w...o......8X.ZD...$.....z....p\|A...j....k...x..o.{.......!.l....M/..(.......N...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.es.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.082872406747305
Encrypted:	false
SSDEEP:	48:6HF2ynJeHQHlXVN+/87sEC8OJc9XUkAbDi4nhQnN98Z0lEsRPr1Se6Bf0s90w63e:9yJe2NO29kr6qh2rrlE4hmf0W
MD5:	40A68634281A56F85EC43BC84495C925
SHA1:	901BECFC32DBDCCA3F0ABE5A0A9863F3AC6280A1
SHA-256:	66857AE9AFE7608A89969A789A041F4360CDB7BBF7C8680C7598C28E4673EEDA
SHA-512:	034A80138CAFD720A6F3592A1544E74F6A19BA02C92CD733CF5E67432C764F3551E67BEC27DA1C542AD2CB7A0415A0A9C17E8E92B7349AA17D996EA5890225C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..f...........!................>+... ...@....... ............................... ....@....................................W....@.. ....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ +......H........&............... ..$...P .......................................M.....Y.'.....'.......k8..7.T..T/.2..\.._4.A..9+...V...x.+....&.>..}(.'..4..4:..b.4..IH.....Q....).....L..l-..'....UoY ..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.062576637150197
Encrypted:	false
SSDEEP:	48:6nnR3HQHlXVN+y27sBC8OJnWu9XOu+AUJpJEvUTROtqbjuVVhse3Z0lEsRPf1SeQ:q32CTP9eMNSROtq29svlE4VmfoW
MD5:	B379750E626191055E2230696A5CC11D
SHA1:	541DE4F45212A3EF4A601CAAD3A45AEF8F401F20
SHA-256:	0BA158C64B6BEC6A3467F8E9038124E3642128CD34A40A32F0A757F2F5E5EBB5
SHA-512:	D5EDEEC95286448B03DA3067AD5B5CB2BDE7D9C8A37950FB7C51D1615ECAB4755820F03F5C111DD29144E0833C44DD9D64BCF57064BE50487A836F7924CA76CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..f...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ..........................................@......:.G#1...~'.WV.;6<...Q:?..Ca.l.;......V.w...X..cf....Q..T...........@;w....C..8.6.....2. ....]`ma...W4..N...t.................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.it.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.03918555963053
Encrypted:	false
SSDEEP:	48:6DDc3RDBHQHlXONEosS685ew9Xia9AWkWVX7mBaIcUQNZ0lEsRPju1Se6Bfjs90O:8oB29jQ9SaGNnhc2lE4LemfjW
MD5:	4EE63E9E77C0CDB28AAD608105998491
SHA1:	1DE79153120F2879E3BB7D4441BA00FF35518670
SHA-256:	04493BA76CEF0F147842B7587BFA39CC0F6F6B02ECA628AB79E6A61BD0B5944C
SHA-512:	3112699FF6BE4FE66C028E55215A230802FDAF22C9D82442017B19B070BB1FD489CB5628F80D3BF0AD1CFF48FC44C9AAEE390FECA1ABE1E76D8A5DCC30CA91A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ...............................................s..j#..^../....a...?.v.Y.E..t\|..RB..1".......2.P...^D<Z"=`.....9.M.0h'.{..]&..FR!..R$.`.N.h".._2.4.f+...2..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.438569076523074
Encrypted:	false
SSDEEP:	96:8QeiA2K1DHD9iqjqQEacyYpVq3flE4QmfoW:jehdhHD9iqjXETyYIC47n
MD5:	12DD224510052F57D31D5353C2578368
SHA1:	42D420B76713BCB4111E0C4D2B71C096E510FBE7
SHA-256:	E7AEF93CC6DC908E9D12989C8758BAB3B74CFD5CD7F3C2EAE9873B9454FA182B
SHA-512:	9F8742418BE556BB16C8F34FBAABAF11AFBEF89FDCE09913FBE063E0B85E03B8BC0389BA7FF4E2B876ED1C4B90197828FF8FF875474EE85FDBA3E095A0F6E094
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!.................+... ...@....... .............................. "....@.................................`+..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H.......p'............... ......P ..........................................6...lAk'y&,.{.V.D.mR.h.tY.....wm.4c..Z..3..tm..&..-.......^.3..o.t.p....h._a!\....ij..^..x.}.....#{...}k]...........^...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.299061662650153
Encrypted:	false
SSDEEP:	48:6DDMVH4HQHlX7NyVj1oDT480Jgq9XBaAlCkt8/L22lb7YYbZ0lEsRP5jH1Se6BfL:8926poQp9RRIkbg7Y/lE4B5mfAW
MD5:	3AA4CAFDE01F10AAB8B76DEBFB88A5B1
SHA1:	BBA088903B6B1741F3109D7A4AF874E556A6EF8A
SHA-256:	4AD001DC301B0174567E6E8A86E3ECCAD4CFD32523441FEA7ED5F4FA0BE7758B
SHA-512:	3B0CF138CE90C60F086F94A62B8C2C0C346D9410E83AD1F01E65EBA8AC5D8440910BFCB22176C05B63F936285BAC2B0F4A4B6E11E6B4B4C7BDF8179D3E939D98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!................>+... ...@....... ....................................@....................................S....@.. ....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ +......H........&............... ..%...P ........................................E.gl.(.BZ..{..'.~g>W.".`..!".=.../.LgaR.=.......@J.F8X.I{.....O...u}.a.>l...wS{...u.{.&%}...G'......uB......,S..U.h...a!..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9875113412696703
Encrypted:	false
SSDEEP:	48:6DDqqEdXDXbHQHlXVN+cz2E8vc2pb19XTgAub37HVSQPWoy5RAZ0lEsRPjb1Se6I:8XUTL2Bh419D/uXEysP3lE4r5mfTW
MD5:	49E9AFDC05E21DB52D35836EF382F724
SHA1:	1A87661EB54D6742951CC74673E769FF11ED0BCE
SHA-256:	88C86A31BEF5F0B50CBF342749C51E42958ADCC2F83AD8E05AB2DFFD9FD7FF65
SHA-512:	4673620EBEDA4CC723F45771C347D5757E38CFE5BA536F57956BD158A47F4154ED7DA9C98909FF61440FC2A564896EA26ECEBABFFA0FB9B3977927C49B58F85B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!.................... ...@....... ..............................q.....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................9.+.....^.t....H...].[1.o..p.-Mv.....O.U...}.l._[.G..y\|.../...)..f.u.X.LF\..I5.O-.+....).c..(..A@...o.ax.~qp#p...T.O..]e...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05224128243754
Encrypted:	false
SSDEEP:	48:6QKvkHQHlXONELGKE84zp9XYtAokiJrnyOlY+gZ0lEsRPMR1Se6BfDs90w63XT8/:yk2M9H9IW3syOlYalE4smfDW
MD5:	F5BD1E37D61DC121B4F07D4711023F7E
SHA1:	556F4A3305C6214F15BF36048568BD2EE7388879
SHA-256:	9CE7A9D7197CF382138EF1E585CFC67D08A0B5940B5F87685EE122ADD9BE0889
SHA-512:	F4CC41E1BC623AB08FDB32EAF44484102817F7B629DBC61CAEC1D948274C8A633F39629ED666B0E783FF9EBA9E889DBDB2B4E48BA7F54A6552CACEA695756071
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................... ...@....... ..............................`\....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P .......................................F...%).K..H..{...J}.....H.F...g}.V.T./.8...>....R......x.6Z.;.{.6.AP#..R.z.y..!.I{..." .I......d..h.....=.A.....E.u....O................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0548170504617085
Encrypted:	false
SSDEEP:	48:6QWlKLJeHQHlXVN+/FB480fB9XXgA9Dah4elgQCkhRO50lEsR+8o1Se6Bf/s90wt:rte2k2X9H/27nC2RtlE4Emf/W
MD5:	26C0E4235C67DC354BFF94EC95D4DD6B
SHA1:	E11E32204CA626768406BF2EE8661C5A6ADB01D7
SHA-256:	8ACEDC2916603A278ECAF7719A277A36A7362739023C8CE1E0AB42D97BC10D68
SHA-512:	DE42C4AEB0712D5D56D49861A0F002B61C6BB738B285820414588DDD83622F61304AEDA1BB49BB170CFCCBD30C53000791002E2660F4016DE904905441BA0D5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................+... ...@....... ..............................+(....@....................................W....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P .......................................P..e.c..uT.c.d{....+.i.#..OT../..L..`J.vv..Xju..8..!.......0..2.ffE.......-..C2$.)V...r.1.2h.{.U.._.p=..kfX.._.@..('.i..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.048592937646518
Encrypted:	false
SSDEEP:	48:6PoiHQHlXVN+/1od3lpc88jLc+9XLl+AhDk7QPkhRO50lEsR+CW1Se6BfXzs90wt:22aod3laRh9blNpP2RtlE4KmfjW
MD5:	8E04A4820F073A6CDB5CDC08A549332F
SHA1:	B9CA3C1918FD0B68967DEFF2C9C47C089F5E6B96
SHA-256:	0D0762D0C1E7C0C73353553337CB835C1B92879394600137C33CDF5F354C416B
SHA-512:	906A06122AACBAE7C00266F439B85A109128707EA86DEEECC7452A6BA2B085C0F838E5D6434E7AE6CFDDD2365672DF036F60C558246678FC242148342CEEADC1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ......................................l.......5.W.Pc.I..t..v..r.Tj$..).8.......i.2..i.n...d.D...........p#.m...k....z1...L......t...E.-...(..9z?q.x..M..S..ly...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.156219234297824
Encrypted:	false
SSDEEP:	48:66trPj6UgHQHlXnNgZXyrubV850h9X0aKAvuqRwx9UqBE1LcNXH+ILZ0lEsRPl7T:xW2g4rupD9XhsQqyebOlE4t7smfQW
MD5:	D8E8BE64281A57443D47C521B40D84BB
SHA1:	367C6DC19F4357D47E3F6CD675A76E247792F553
SHA-256:	91CE4CA0D1BE1CD3B9089A24195183069F25A708C1D746D3DFF960F59B5396D3
SHA-512:	616C3D011DB4A36AF7AC5C007843C7E8EBCE7A075BE3087A9946A833903C38D148FA94BB4941837D2AB1E90A343069B4F625D821CCEB707B494000240CC82459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................,... ...@....... ...............................i....@..................................+..S....@.. ....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................,......H........'............... ......P .......................................W7..r..q.dQ....+4...6I.5.H<.Y...j.U.J3....#.m....Uj...p..E.=..6Qb.C"G..#.%...$...N...%..?...4..n.rd.p..#........d...................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.080918503374663
Encrypted:	false
SSDEEP:	48:6Fxd5HQHlXONEVHg7Q8NkjWu9XPJA2k8it+SEVovWaCZ0lEsRP+VH1Se6Bfzs90O:U2//39fKtb0nVovjlE4WVVmfzW
MD5:	04F215F39174F685D97944543FF1504C
SHA1:	79336540EA595603E8EB70FDA775EB58A4617118
SHA-256:	4E7FE0ED22DA1ADC3465296D7518DCE33FD43F4ADF0676177F76727A31ADE446
SHA-512:	31E6BC062628C8F9DB633ECB96B1AA5C9CAA3502D92AE41C833B8B61BC8129C7E77365A762E2CDF5D50963935810EE4B5583E8826D6C5A2476891D09011D0EC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................v..U.;.e....3..^...b.Tzx.9..r...\......\|.).D.....9....x.....6I.\N..~.H......'...}Ln...S.KPb<...W.....)...S.<..a .f.w.....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0290727379888205
Encrypted:	false
SSDEEP:	48:6MKB83CHQHlX7Nyo3Hz8olXgp9XHVAWOyqQlYAA/iDQrZ0lEsRPW1Se6BfXs90wt:YeS27Thl89XeelE4+mfXW
MD5:	3B54570D6D6724318ADC3FDA5325D28C
SHA1:	28950B3565DBF877564DD40B61D10F4D514EDFA5
SHA-256:	223070A04B6E5E551BDB9CF9D2EABE8C3D0D1BA39AB8032A3B7C1900DF1A2A7D
SHA-512:	913B587AC593E1A43A67392DF61634DC20B35D54815AAAE0C6ADDF90F9999A7663AE1A122BDC59D6EF61B72E266562D9D4F6B800B6993862FF1DCBC59AB166EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..f...........!.................... ...@....... ..............................,.....@....................................O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................JL......,m&.....1.~.T.....{c......J..;"".:M(R...+!..$....5 .@...Q."a....OK6..9.KL..c.7.\".[H.5.D..f..s.....28b....z'.7#..&.g...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0836365128627055
Encrypted:	false
SSDEEP:	48:6KaqfDHQHlXQNg/mpo89hE+9XPZABiLlFFOy2dR7iRZ0lEsRPGA1Se6BfHs90w6O:l72K+w9f6BGl4F5lE4xmfHW
MD5:	479C987D50BC134FF0773B5B79447040
SHA1:	A4F3AAF56086EFEF69682FF9C6E168A7D73C3EE7
SHA-256:	72FD45BD5D975B6540515CC571068F34E172A116134D0A7F55110958BDA2BE35
SHA-512:	768D2E922004D54E23C1DDDA801FE6B115E38198ADB4172E8943DE36730A221DE134471EA2584A041CF31339B5E0A74E2DFF978DC6DC02F10856EE58DCE199FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..f...........!.................+... ...@....... ....................................@....................................O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................!Q...G.GFx../{...5.9`.>..~.W.SG....b..\|5B.i..T...!...e.6...R...%.r..J....,u....~.....M....g....0.p.yv.& ..va.s\,\|.l/......^.V...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.2355557611221535
Encrypted:	false
SSDEEP:	48:6w5bT2HQHlXONELhb4+8nKfq9XUeAz6k6AbZ9ky3eBy1550lEsR+N1Se6Bf/s90O:y2TE+fi9ktFpfr3olE4wmf/W
MD5:	67D2B049B042F06E131F4ECC24CA7CD1
SHA1:	C910E31EC1569A1D0D09E9DC311DE54C006BB288
SHA-256:	2AB92367370CC3E9CB64C1394249D0F5A9112740E6097C58529FB232E75609F8
SHA-512:	F1DF4EE9390E387F3B5DFC5775FED089138662F41D551E6EFAFBFBFF84A5663D83482414C6FB3E4369FB17F2F883C75351E9F534001C3C8C16DDF5FFF9F8B3AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'..f...........!.................... ...@....... ....................................@....................................W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ........................................i..N.>.h.....").F;.,.Td.k2...w..}.....%wQ...... :o..V.....!q..>U#..&.U.{.........a+.?.j......8e....\AG(\0.!.._..P...4..F}...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.199486773906579
Encrypted:	false
SSDEEP:	48:6JEGHQHlXON2NsOVp+8CpTL9XFMAKSAneELusDHYZ0lEsRPru1Se6Bfvs90w63XO:bG2WOiN9VzRuPlE4DemfvW
MD5:	0617F841FAA9113634392278A28CE05E
SHA1:	6153BC5E9517A7183ECB011CC8D19C4579ED27C1
SHA-256:	2CEFCE0265AB3DE45C1C55E5A596D8F3DA819EC9651C41F93C108E4D6DD2F014
SHA-512:	6B1D473D98A5CF3CE9F4350D06CC5CEE9F02EEB3BED0AC8EB3ABCE3ABB5D04621C98D6C116E63061D7C9F0FE032AC2E971BC864218D7D094E2B13A9A016DF41C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'..f...........!.................... ...@....... ....................................@.................................t..W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ........................................(t{.w.....={.L"i...e#.U.N.]I.1{_........a......i\|y .4.....4P..Lm....^...)..:7.M.>...^q..X..D1K..e.;OD+..?B.A.]../Pn..^...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbahost.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122288
Entropy (8bit):	6.643662045821993
Encrypted:	false
SSDEEP:	3072:iyjfrCvv4JR5zsemsABCF0TPSLNegl/+b:xrrCYRsehsIX/E
MD5:	C59832217903CE88793A6C40888E3CAE
SHA1:	6D9FACABF41DCF53281897764D467696780623B8
SHA-256:	9DFA1BC5D2AB4C652304976978749141B8C312784B05CB577F338A0AA91330DB
SHA-512:	1B1F4CB2E3FA57CB481E28A967B19A6FEFA74F3C77A3F3214A6B09E11CEB20AE428D036929F000710B4EB24A2C57D5D7DFE39661D5A1F48EE69A02D83381D1A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v........................}.......\|..............................o..............2~......2~......2~q.............2~......Rich....................PE..L...Tp.]...........!.....&..........(>.......@.......................................;....@.....................................x......................................T...........................H...@............@...............................text....%.......&.................. ..`.rdata...s...@...t...*..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188848
Entropy (8bit):	6.598346436496911
Encrypted:	false
SSDEEP:	3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
MD5:	FE7E0BD53F52E6630473C31299A49FDD
SHA1:	F706F45768BFB95F4C96DFA0BE36DF57AA863898
SHA-256:	2BEA14D70943A42D344E09B7C9DE5562FA7E109946E1C615DD584DA30D06CC80
SHA-512:	FEED48286B1E182996A3664F0FACDF42AAE3692D3D938EA004350C85764DB7A0BEA996DFDDF7A77149C0D4B8B776FB544E8B1CE5E9944086A5B1ED6A8A239A3C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:v.O~.c.~.c.~.c....t.c......c....f.c.,.g.n.c.,.`.l.c.,.f.a.c.wo..z.c.wo..c.c.~.b.\|.c..~f.g.c..~c...c..~....c.~.....c..~a...c.Rich~.c.........PE..L...Yp.]...........!................................................................1.....@.........................`.......L...................................`.......T...........................H...@...............\............................text............................... ..`.rdata..2...........................@..@.data...............................@....rsrc...............................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.png

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.648767094164769
Encrypted:	false
SSDEEP:	12:6v/7rW3M/jDYAlFTzdvhKZ7e/cbp4/82UNb6MjmlKPNXheD1H0oJodqSXaTbutak:lQD1lldv8Z7g04/82Y6+Pxi19mDoqt5
MD5:	A356956FD269567B8F4612A33802637B
SHA1:	75AE41181581FD6376CA9CA88147011E48BF9A30
SHA-256:	A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
SHA-512:	A0F7836AEFA1747F481C116F6B085F503B5C09B3A1DD97CD2189F7CE4E6E7EA98F1F66503CBA2E6A83E873248CC7507328710DFA670AA5763DF8AEDCC560285E
Malicious:	false
Preview:	.PNG........IHDR...?...?.....W_......sRGB.........gAMA......a.....pHYs..........+......IDAThC./W.0....P(...Db+q8$.........J...-..8.e]._..;........Y... .Y....z\........{W\|..../q..<%.....C5...0....OrU....,..^........).....2.......i.Ge..T9T..}.7..J.......}..b...S.>.%y..Fc..j.X.....y."...e.U..M(ez....4\..C....u.......w..0..J.Wo."...mM.r.h..8..q..X..k!...j..xn...l...W`..r.+.R..J........c.T.}......cz..<43..@.c..rH...\|..V.....K.mN.........k....,..4OL..5..M.tm%=.U.t-7.w....k.R.....c...-].5~..]2..5...GA..[..={.5..].=(.$}.\.9..5...MWu..[#.....F..j.F...d...,..MWu.7..3......$.......G.t.....=;N<_:[......0.,1.y.\.Z.\|..%..>}...q.s....y.#p......!-.;.6!o.KO..E.6...........<..c..9_B....y....im...b...Xn.....)t9Q...........V.WMtP. .P..Z.&..KR.ac......IEND.B`.

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.thm

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	5.15881451198739
Encrypted:	false
SSDEEP:	48:cecHddpXBT2E/zPHWgtpmAPH8TSJmBP+NPHrM/O8YpQbFUuhJ3PK7usPH4Lr:wHdHxS4Z9UG4BmNjCOhpsB3PswP
MD5:	A20778EC90A094A62A6C3A6AB2A6DC7D
SHA1:	74C131B5FD80446FFDF2AFAD723762DD36621309
SHA-256:	F8C3A03F47F0B9B3C20F0522A2481DA28C77FECDBB302F8DD8FBED87758CBAEA
SHA-512:	47F34A9F416D223DCBF071E7292A05554AF3D27CDE67FC8C161C1BED564C6E7FC448C2F482E05F33149C782E09C681BD65730CA00CF9EC68B284128214B75529
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="mbapreq.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="96" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="112" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.076345322304751
Encrypted:	false
SSDEEP:	48:cxX7DxMT8dbCsK19Wqq8+JIDxN3Wm2WcN3miNlLPDHXsmkaYXfXQ2BmGA7b1fABP:8LuTY1xmmmTerNR0AT1O
MD5:	4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA1:	11577021465379E9D1FF4260E607149BA5DFA6B3
SHA-256:	C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
SHA-512:	AE791C1F05821167F1D2E1D07DBF95FE7E72B35B3E4B1E22720006C7A672B1330B748414792392B0E806F111AA4EFC1C424F4479EBDE349E3F079792DBB3BF47
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">Microsoft .NET Framework required for [WixBundleName] setup</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. By default a log file is created in %TEMP%.</String>.. <String Id="HelpClos

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\nl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.514537996195169
Encrypted:	false
SSDEEP:	96:IgSDCrKnE1hLayI9YnGf3HV7zf4j3J+QYzpyJySRIuZHBH//xxx6npSzXdZuM6bA:IFWrJLIKIOVten6WVtxz1oam24OA/e6
MD5:	51BE3049E0DE8D4F11CC3BD913C1E629
SHA1:	CB978E5CFA7E10E5378506756CA751FDA77FFDBE
SHA-256:	E22A42D3BEF52F19366741F8A3163B0096089AC94D3DA26375BF801F040BE187
SHA-512:	916080E28B43976DD569FD9E39DE6D45DA22591A0DBAEBFB10E5AB55AE2D94EB535F13384C26131432BF640DA8541089BBED2D1F75EDABB859022C56B0083344
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(..........nF... ...`....... ....................................@..................................F..S....`............................................................................... ............... ..H............text...t&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................PF......H........B..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\no\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.035848732135575
Encrypted:	false
SSDEEP:	96:kXSPLaH3wv/82jU96MYugRYuMp9Lxtw9s65v0lC6o6:kXSPL3eppM2zm6
MD5:	D0615BF005FE7A4ACE981A933156B1FA
SHA1:	784F5EC4423A48EEA2E363A62C3B450B6D55CFF3
SHA-256:	2EEA4212F47F9C9FCD310714BAEFD00DD22F1CCC82D34DD6391B326916F539F9
SHA-512:	8E592C057C7351BB88ACDCFF3744E31AC4CE2AFF4BCB6CCF7A0BAF3F9CF8E44FD36D2006528CBD5B096CEBEE09FA15CF87ED5752CA80819A73142D8CDA78F4A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.................2... ...@....... ....................................@..................................1..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H........-..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....(.......PADPADP....../..bq....u.j....;..\.......9...7...#............. x...n.(/\|..d....e.....k....}.....F. ..:3M.(DK..GO.6Q.i4X..]9Y.`.G<c.0.c...j.S.l.[.m..t".\| ..}r.......i.......x...........`...-.......................C...........

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.650318035012639
Encrypted:	false
SSDEEP:	192:gFWraoHJ/k+VDjnkjlCQyN3dZdEDvg91NyIG3beIB36:gFVoprBjkjlCQy7zEDv81NrWeIc
MD5:	4B4F338A900DB800B2271DF45BCA26B5
SHA1:	F8C3AD25801B49D80D59C9D3100E8C4B701390FB
SHA-256:	ED60F9E4D9CEA66E8B759D63D92D417E48931B8FF88C0E29FC4F83CCF7004700
SHA-512:	4588D816D86830BEDDC89DFD07A8C8090A07C66DC1CB880968C6235EEDBDB292556880499C576CB8B29ADC0611FBB4E32C1F6BD5EED63A92651F4FC33DDAFB1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(...........E... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................E......H........A..............P ..d!..........................................`!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-BR\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.556427702744662
Encrypted:	false
SSDEEP:	192:l2FWrD/d+TnOqn8CJaedAxC+sKeU8gMZfqJJKs6:l2FYdgOqn7J/T+x8gafv
MD5:	AC4AD057DBCB6EDAEA55A1F40C7557F8
SHA1:	33634728B400D64A6A5AF5AEA7826C36AB6B88F3
SHA-256:	A59193C831B5D6EEB404F523BEEB638B795040D248438ECEBAA17C0F450C5610
SHA-512:	CF4DBE894352391EDBEEA26CC4CC50DE0807B638B03EEF4895F0AE67E2D4AF1FD0089ED0F4A7035F00E61680021E1E0A270D168737B567652430764574348FB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(..........NF... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text...T&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................0F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\pt-PT\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.554067565224853
Encrypted:	false
SSDEEP:	192:VFWrP91G+JnLbOymhU9+wHnA9MDGBh7Jyf6:VFAGq3O/U9+6A9wCx
MD5:	F6DFE6DAA0BEA843DF5FABBB80CC61EF
SHA1:	B061170F0A5AC2EF6C2B9EEDBCEBB8B191A43816
SHA-256:	504F8E1020C8642645B4A26184203B48C58F3F22E5B50EB7AF23B589AF6B787E
SHA-512:	0445AADB8C00B7B4316146BA2A3F535152960FC686F2CA7927574EEE21BB9DD4FEBCABDFED4A3E10438B008936391AF505BD12AD08D05E111C51DF5D53CE8D69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(..........NF... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text...T&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................0F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ro\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.394984792490585
Encrypted:	false
SSDEEP:	96:NBUgrr7kJMp3jGUBWBJ/7iGejoLm/S0ynpR9i2PUQzHkmmrY0m7rXf5PEKhtJu0G:NBUKkJWZsHj/j3msrHtESXr6
MD5:	F61FD6F0DA7A4C85DCBC3B5F612B3717
SHA1:	E64E93B9C51A533516234C82D08A43416ADED6B5
SHA-256:	D5A6C506D014C8B4248C3A4421E27924050C265129A5B1B201AB6A37F2710364
SHA-512:	E1D42CB1A0AE98D6B165C2A30033962F98D891B50E1825B72C752D98E0C4F16A0054D0FA3F74BF1E2AFF80C3AF69E911B5582C1480748270B7405ECB34EA4E82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.................<... ...@....... ....................................@..................................;..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........7..............P ..}...........................................y..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\ru\AdGuardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.981177943200566
Encrypted:	false
SSDEEP:	192:aFWrI71qbtQIcPEPbdUe1SxLu6HnwXfvahc71VGCq6:aFhmQNPEPbdUe4NY6hc7D
MD5:	6B9442929837FCAF82BCD50ED6859F0F
SHA1:	CD61F19D600D360739732B24377EBA19DA3CA2C1
SHA-256:	28F0CB4B60D87C4D8F564A0536BC9B85F5A991340FE08EE8DF5F5765A8398C71
SHA-512:	8E9B933371D399A12AF3FE1095746F967B2EA4EAA050FFFB70E2A6D66D1C04619AE86F46B711685C9D925FF8E2800164A8A63E4922AECC3EE231A8EBEFE23C2D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.................M... ...`....... ....................................@..................................M..S....`............................................................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H........I..............P ..<)..........................................8).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.635973382285296
Encrypted:	false
SSDEEP:	192:+FWrNy6z/3Frstpwriqz1z96Zxl3Ef5lGYVoA6a4OZrNl4lZ6:+FX6etpwriY1z9uc/v4irN
MD5:	875F4E73A888287E47843F0E078DA3F6
SHA1:	4DBEE9CA918E7298452C1D3C3D94C32FEB5FF5F6
SHA-256:	7549461164FD6E6D8D28560D31DC3E1E186B8ABC8BE983FD30F514F3CC561AF6
SHA-512:	9D6AF86BB481DBA1CCA27D1B1E033C1FF88E897E7E3A01F1EB375555F76804C6645AD35F135A67C8517DDE665E85E764F817481A1932761772F1249826CD1583
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.....&..........nE... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..............P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\sr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.483328555735341
Encrypted:	false
SSDEEP:	96:F5BUgrmJiYfHP+0xk5Ab/Y7lmjeKh84RyIaR1f0qylbJiCsYmRu3tcIGg81RbZGz:F5BUyYfveA8Ck9gKdoIwVy6
MD5:	86ACB497B738B450683E470AC526337C
SHA1:	12C815183D35249E31BDB2C700151149B262451F
SHA-256:	A08C08E4C0CDA7C86DF6305B772A4E43E2D3F41ACB5E070FA61B46D2207423E2
SHA-512:	07E3AF82D10B5683D09D9B57A50B43A25405CDA1D1051200AA43E675F4BA039FF6EE366A88AA98D84E09BEB2995A85D1638F7B11B88C8DD636BDB0262DDC5D5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.................;... ...@....... ....................................@.................................L;..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P7..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\tr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.641037867562977
Encrypted:	false
SSDEEP:	96:rXgSDCrKnlhjHzO1Ao1mgzciYSUv4OKjOsDv4wA2yK7HRRm4ri0w+xj4tsB+uKUF:rFWry5O1AoAUL4h0jxKU5zBhywSCm6
MD5:	C77727FC0C4302F74469E5EAE4152452
SHA1:	6D227E4E2168432B85D711ACA7BC9F3F8E1F6066
SHA-256:	3EA569FEA7304A2B89156B32699A36C3B579B7CDE8298B1C938EDA40284FCAA2
SHA-512:	2688AEE13E8A207B02619A450C05A016F5AAC91816D65C129D35D2DFA3B6C31257BB882CAFBAA59A9D841A3F1A60C984F2BCA6920360C62513BFC018AC763E5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.....(...........F... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text...4&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\uk\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.842200970647284
Encrypted:	false
SSDEEP:	192:jTBUXUn/Djum3N6Vj4FmqgaxYCsrYhDqFp4FmWy6:P5LjumQVjwmqgaxYACpwmq
MD5:	951AC7C290127F2FC3E5A0854D862458
SHA1:	CC01CF4E8D9CD58C3310E9A704CC5E48385AB128
SHA-256:	0487C6C5BBFAB66329AC64FDCEB8C95AC6EB259ACB46348CFC39ADA758612A61
SHA-512:	62BBCB36DF694987EF5DF5D2E9011A8D4FB658A3CB3DC214CFF900C556CE4FCEEBBFB086E07FE495BE056556DEC797DF974532C55ED51C8ADB09EE3ACC85B672
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!....."..........NA... ...`....... ....................................@..................................@..W....`............................................................................... ............... ..H............text...T!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0A......H........<..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'.m..it..t".\|...\| ..}

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\vi\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.954569059030031
Encrypted:	false
SSDEEP:	96:0gSDCrKntvIETAOAjlZuswNsHajkj4+dxuBdKycHo7R6TOd3CtpOe0i3B0Yk63lx:0FWryhArxcE3x3CYkDQ8DqPePrYSn6
MD5:	4795950D156A216F9313094FC7388A14
SHA1:	DFA30DB9ECAEAE2A468DB38255C7AA8A455E459D
SHA-256:	0545E1C0CB02B9A36E627F960EFFB6E9CFD1EBCBD699DE0469EACDCFDFF6EB13
SHA-512:	0F422B4B763E266F73A80BDD2C4F646A9F54F236156D68D357F8AF8C24B266DF5B47FFC3520AC83A36D1A0FF124D43BA4F61B019FEDBF2E072FDACE613BE5005
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!................I... ...`....... ....................................@..................................H..O....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H........D..............P ..o$..........................................k$.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh-TW\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.185978321611355
Encrypted:	false
SSDEEP:	96:W9gSDCrKnsblHSWUT9WYfXOd8nzIjXDJ3OeOhZyKyhiHDRR1HkuXmFrPGVwPzbct:W9FWrldSWUwXklgSmrAY9pCrRlG6l
MD5:	7FE0EE444DFC4CA8F0E48E8797256355
SHA1:	9BF99EB702982AB9B70AFB9B1AD86D462FB9C97A
SHA-256:	428176371D2906B88F3EF32B0843C65076E51F05818423887ED6AB0F43DD8AF1
SHA-512:	21720C27C104FD611902C5A402569D118D68AECA2CE3D5FAAF2EAA38D1C07A9786D8C8B3D2270FCA6866BE3A0DA1C480B141D668A4A617E5A447C33EF3296F23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!.....$...........C... ...`....... ....................................@..................................C..K....`............................................................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......\|?..............P ..)...........................................%..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\zh\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.13805347376527
Encrypted:	false
SSDEEP:	96:NgSDCrKndIs4/hlGyaJ0Y1YoK7j+DJ0DDkJynKVKpR/P5DGQazTxkNvGLWtb7L2M:NFWrO4jMVQgzTKYIb+Lyi2+v6
MD5:	943EACAFABFE5B965265C3E63CD16D27
SHA1:	CD043D9BF851B39881B6A80489ADCA5E7E13E839
SHA-256:	8113B72FA0FE9EFD16134EB9945B02066D40B749722268D3133E6B56D3AF1968
SHA-512:	EC4F2287D83C98E13A8EEEF522E8143612656ED0ED79CA01989DBBCC53C8DD4C73FDD1524F7FE474F0F3F2DAE557E0A746511851E5388F7D696C16AD4CC62C91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!.....$...........C... ...`....... ....................................@.................................8C..S....`............................................................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................pC......H.......<?..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7303192
Entropy (8bit):	7.967426283225315
Encrypted:	false
SSDEEP:	98304:BT0tEi9DACSh5mX6Ars1y2+A/6VQdn0t0KoBiuYNB8Fmvm0rgI5t5yYMWd+pfSjv:BTKeqSd+E07tTuiDX8wv5r94dib
MD5:	29467FD9BE93C4AC0BA9D863AE30EDF9
SHA1:	F19CB3F6DA9DD998E0BFB7183D13CA9B592C7899
SHA-256:	EDB674894994D5CAC133ABEC9E5E2ECE8560DC8BCC70A3BF94D341C87A15E8E2
SHA-512:	164AFBA38BDDD8411800886DF66599DB53EE979D4320BD9B986F716F7C287588EA63F8FD01027C838B50ACA22FC10B60B42CBFC66DD53465F741A90FF162458C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@.................................hzo...@.............................................T...........@Co..,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.980720397663175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File size:	116'256 bytes
MD5:	68b15abf143f5df8aad10eab1d2513d5
SHA1:	cb2566d06a85191582ab524d68f38d85556fb880
SHA256:	c1aaa8b374f0c43ae3d8817ac7731f1f71d2d04089e9c51510cddf38097dfb54
SHA512:	16d50a5e8ea66ce235614cfc51da3bfbe0cd9d2e2262954f0a15419c883d44121b432b6a84ab1c36ec1e4e5fcd364959b4960b7354339300e764697f7bb5c8ff
SSDEEP:	3072:L4GZnrASj3/XQLFvGwFCZ+XH+Im8wp7aO:L4GZrr3/A1B4p7aO
TLSH:	4CB3A04AFD4360F1E91BD970A68BFB3F8630E32784149DA7FFC64B05E9627B2640A105
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..c...............'..........................@..................................w....@... ............................

File Icon


Icon Hash:	0771d0d2250b3b8e

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6390A073 [Wed Dec 7 14:17:23 2022 UTC]
TLS Callbacks:	0x401780, 0x401730
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b26a7e001a4be269742be838dadc9db9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	13/01/2023 01:00:00 13/01/2026 00:59:59
Subject Chain	CN=Adguard Software Limited, O=Adguard Software Limited, S=Lefkosia, C=CY
Version:	3
Thumbprint MD5:	97CB1ECDC7F0BCBB54ACA397BB03E6D1
Thumbprint SHA-1:	48BAFFCE2694F647A33854183A4B817BB8A7DBEA
Thumbprint SHA-256:	453226C42EB62A278F091B0155200D76DD284A1337795B6EB37A627D414F1284
Serial:	00B138E6660DCA7CC377CB2F6F6027F616

Entrypoint Preview

Instruction
mov dword ptr [0041106Ch], 00000001h
jmp 00007F50E0888956h
nop
mov dword ptr [0041106Ch], 00000000h
jmp 00007F50E0888946h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F50E088EF8Eh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 0040E000h
call dword ptr [004125F4h]
sub esp, 04h
test eax, eax
je 00007F50E0888D15h
mov ebx, eax
mov dword ptr [esp], 0040E000h
call dword ptr [00412658h]
mov edi, dword ptr [00412608h]
sub esp, 04h
mov dword ptr [00411028h], eax
mov dword ptr [esp+04h], 0040E013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 0040E029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [0040D004h], eax
sub esp, 08h
test esi, esi
je 00007F50E0888CB3h
mov dword ptr [esp+04h], 0041102Ch
mov dword ptr [esp], 0040F104h
call esi
mov dword ptr [esp], 004015A0h
call 00007F50E0888C03h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12000	0x1d0c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x8310	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19600	0x3020	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f000	0x7ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe488	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x124cc	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb0d4	0xb200	795976d8ade88f24cfb013314c16a55c	False	0.5650237008426966	data	6.245149254196926	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xd000	0x4a4	0x600	b13fe574645c82b1d74955ff3c177ab0	False	0.10416666666666667	data	1.0748674966658749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe000	0xbe0	0xc00	cdeb491c9f8ed943fbfa4e5a64126cdd	False	0.5481770833333334	data	5.322586268721286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0xf000	0x1fb0	0x2000	923ae17274e756093759304ab472082f	False	0.3533935546875	data	4.933913732859542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x11000	0xa74	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x12000	0x1d0c	0x1e00	7cf265bc970978cf36ffcbe8a9a610da	False	0.375	SysEx File -	5.372660458640531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x14000	0x34	0x200	4eef9a9546f6bf89752c594cebb6c33b	False	0.06640625	data	0.2601579489546485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x15000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x8310	0x8310	ae5b95a827ccff784c6821860ea20c07	False	0.8662672865999046	data	7.582095818588735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1f000	0x7ac	0x800	cd529a2d5f29be6c2efba8641354c9db	False	0.84619140625	data	6.519804353028213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x16208	0xf3c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0028205128205128
RT_RCDATA	0x17148	0x236f	PNG image data, 440 x 270, 8-bit/color RGBA, non-interlaced	English	United States	0.9622974313747106
RT_RCDATA	0x194b8	0x40e2	PNG image data, 880 x 540, 8-bit/color RGBA, non-interlaced	English	United States	0.9057796508127633
RT_RCDATA	0x1d5a0	0xe0	PNG image data, 7 x 10, 8-bit/color RGBA, non-interlaced	English	United States	1.0133928571428572
RT_RCDATA	0x1d680	0x149	PNG image data, 14 x 20, 8-bit/color RGBA, non-interlaced	English	United States	1.0212765957446808
RT_GROUP_ICON	0x1d7d0	0x14	data	English	United States	1.05
RT_VERSION	0x1d7e8	0x260	data	English	United States	0.4753289473684211
RT_MANIFEST	0x1da48	0x3dd	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4620829120323559

Imports

DLL	Import
COMCTL32.DLL	ImageList_Create
COMDLG32.DLL	GetOpenFileNameW, GetSaveFileNameW
GDI32.dll	CreateCompatibleDC, CreateFontIndirectW, CreateSolidBrush, DeleteDC, DeleteObject, GetDeviceCaps, GetStockObject, SelectObject, SetBkMode, SetTextColor
gdiplus.dll	GdipAlloc, GdipCloneBrush, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateFromHDC, GdipCreateHBITMAPFromBitmap, GdipCreateSolidFill, GdipDeleteBrush, GdipDeleteGraphics, GdipDisposeImage, GdipFillRectangleI, GdipFree, GdipGetImageHeight, GdipGetImageWidth, GdiplusShutdown, GdiplusStartup
KERNEL32.dll	CancelWaitableTimer, CloseHandle, ConnectNamedPipe, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateHardLinkW, CreateIoCompletionPort, CreateNamedPipeW, CreateProcessW, CreateThread, CreateWaitableTimerW, DeleteCriticalSection, DeleteFileW, DisconnectNamedPipe, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FindResourceW, FormatMessageW, FreeLibrary, GetCommandLineW, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDiskFreeSpaceW, GetExitCodeProcess, GetExitCodeThread, GetFileAttributesExW, GetFileSizeEx, GetLastError, GetLocaleInfoW, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetNativeSystemInfo, GetNumberOfConsoleInputEvents, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetQueuedCompletionStatus, GetStartupInfoA, GetSystemTimeAsFileTime, GetThreadTimes, GlobalAddAtomA, GlobalAlloc, GlobalDeleteAtom, GlobalFree, GlobalLock, GlobalUnlock, HeapAlloc, HeapFree, HeapReAlloc, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadResource, LockResource, MapViewOfFile, MoveFileExW, MultiByteToWideChar, PostQueuedCompletionStatus, QueryPerformanceFrequency, ReadConsoleInputW, ReadFile, RemoveDirectoryW, SetConsoleCtrlHandler, SetConsoleMode, SetDllDirectoryW, SetEndOfFile, SetEvent, SetFileAttributesW, SetFilePointerEx, SetLastError, SetUnhandledExceptionFilter, SetWaitableTimer, SizeofResource, Sleep, SwitchToThread, TlsGetValue, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile
MSIMG32.DLL	AlphaBlend
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _daylight, _errno, _initterm, _iob, _onexit, _stricmp, _timezone, _tzset, _wcsicmp, abort, atoi, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, memchr, memcpy, memset, qsort, setlocale, signal, strchr, strerror, strlen, strncmp, vfprintf, wcslen
ole32.dll	CreateStreamOnHGlobal
SHELL32.dll	DragFinish, DragQueryFileW, ExtractIconExW, ILCreateFromPathW, ILFree, SHOpenFolderAndSelectItems, ShellExecuteW, Shell_NotifyIconW
USER32.dll	CallWindowProcW, CloseClipboard, CreateAcceleratorTableW, CreateWindowExW, DefWindowProcW, DestroyAcceleratorTable, DestroyWindow, DispatchMessageW, EmptyClipboard, FillRect, GetClientRect, GetCursorPos, GetDC, GetFocus, GetMessageW, GetParent, GetWindowLongW, GetWindowPlacement, GetWindowRect, IsWindowVisible, LoadCursorW, LoadIconW, LoadImageW, MessageBoxW, OpenClipboard, PostMessageW, PostQuitMessage, PostThreadMessageW, RegisterClassExW, RegisterHotKey, ReleaseDC, ScreenToClient, SendMessageTimeoutW, SendMessageW, SetClipboardData, SetCursor, SetFocus, SetForegroundWindow, SetLayeredWindowAttributes, SetWindowLongW, SetWindowPlacement, SetWindowPos, ShowWindow, SystemParametersInfoW, TrackPopupMenuEx, TranslateAcceleratorW, TranslateMessage, UnregisterClassW, UnregisterHotKey, UpdateLayeredWindow
WININET.DLL	HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlW, InternetOpenW, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/22/24-06:27:57.276819	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49734	80	192.168.2.4	156.146.33.140

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2024 06:39:36.358251095 CEST	49708	80	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:36.363117933 CEST	80	49708	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:36.363204956 CEST	49708	80	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:36.364862919 CEST	49708	80	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:36.369651079 CEST	80	49708	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:36.997765064 CEST	80	49708	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:36.997854948 CEST	49708	80	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:37.006697893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:37.006748915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:37.006825924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:37.017488956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:37.017513037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:37.708985090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:37.709069967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.049627066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.049685955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.050590992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.050679922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.053082943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.100533009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.477663994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.477725029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.477775097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.477785110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.477843046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.477881908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.477915049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.477947950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.573609114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.573663950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.573697090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.573728085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.573759079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.573781013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.604464054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.604501009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.604563951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.604581118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.604619980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.604640961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.646120071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.646147966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.646203041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.646209955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.646241903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.646260977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.678313971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.678354979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.678409100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.678423882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.678467035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.678489923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.702189922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.702234983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.702399015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.702416897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.702493906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.726836920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.726857901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.726922989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.726929903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.726995945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.744767904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.744787931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.744865894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.744873047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.744935036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.758193970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.758236885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.758280993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.758292913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.758327007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.758348942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.771624088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.771683931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.771708012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.771728992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.771769047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.771790028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.784181118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.784220934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.784281015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.784292936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.784322023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.784363031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.795022964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.795064926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.795119047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.795130968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.795166016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.795185089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.807246923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.807288885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.807332993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.807349920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.807389975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.807409048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.817142010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.817181110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.817222118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.817234039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.817260981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.817281961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.828154087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.828172922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.828232050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.828238964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.828291893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.836817026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.836837053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.836899042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.836905956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.836946964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.846757889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.846777916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.846836090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.846842051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.846899986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.862363100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.862422943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.862447023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.862464905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.862497091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.862540960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.874552011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.874608040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.874744892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.874758005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.874820948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.885787010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.885826111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.885880947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.885893106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.885926008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.885946035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.896367073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.896408081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.896446943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.896459103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.896503925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.896558046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.907902002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.907943964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.908082962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.908097029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.908160925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.918822050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.918867111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.918952942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.918968916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.919013023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.919034958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.927428007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.927449942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.927526951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.927536011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.927577972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.937315941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.937340975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.937419891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.937426090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.937494993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.953252077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.953295946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.953342915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.953355074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.953421116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.953421116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.965431929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.965487957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.965529919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.965543985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.965590000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.965606928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.976402044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.976444960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.976502895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.976521015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.976541996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.976588011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.987063885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.987083912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.987252951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.987260103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.987306118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.998447895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.998469114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.998655081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:38.998661041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:38.998707056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.009551048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.009571075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.009637117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.009644032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.009706020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.018373013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.018393040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.018455029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.018462896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.018502951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.028065920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.028088093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.028151035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.028156996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.028218031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.044383049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.044401884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.044713974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.044720888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.044780016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.056056023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.056085110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.056137085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.056143045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.056195974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.056217909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.067013025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.067033052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.067082882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.067089081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.067142010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.067156076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.077712059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.077732086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.077795029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.077800035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.077857018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.089229107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.089251995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.089323044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.089329004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.089389086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.100276947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.100297928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.100362062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.100368977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.100414991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.109034061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.109055042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.109118938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.109124899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.109184980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.118606091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.118627071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.118694067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.118700027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.118742943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.134641886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.134668112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.134727001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.134733915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.134788990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.146743059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.146764994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.146822929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.146830082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.146871090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.157881021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.157901049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.158241987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.158247948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.158309937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.175618887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.175642967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.175714016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.175721884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.175784111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.185045958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.185066938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.185125113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.185129881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.185164928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.185184002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.191185951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.191206932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.191273928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.191279888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.191343069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.206305027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.206325054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.206409931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.206414938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.206458092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.211565971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.211586952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.211637020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.211642981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.211673021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.211694956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.225953102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.225972891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.226052046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.226058006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.226119041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.237384081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.237405062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.237473011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.237479925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.237534046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.248620033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.248641014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.255104065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.255112886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.255187988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.266452074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.266472101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.266520977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.266526937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.266549110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.266571999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.276047945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.276089907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.276145935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.276159048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.276196957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.276216030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.282059908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.282147884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.282306910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.282387972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.297116041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.297195911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.297214985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.297245026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.297276974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.297298908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.301820040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.301886082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.301919937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.301950932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.301978111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.301997900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.317007065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.317050934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.317101002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.317116022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.317169905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.317199945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.328468084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.328530073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.328552008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.328558922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.328612089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.328624964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.339633942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.339678049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.339833021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.339840889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.339904070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.357646942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.357690096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.357758999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.357773066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.357798100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.357844114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.367043972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.367109060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.367168903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.367182016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.367219925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.367248058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.372843981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.372888088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.372941017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.372955084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.373001099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.373022079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.388047934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.388091087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.388140917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.388169050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.388195992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.388219118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.392436028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.392501116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.392528057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.392540932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.392566919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.392587900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.407648087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.407697916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.407854080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.407867908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.407944918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.419282913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.419327021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.419378042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.419390917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.419440985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.419462919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.431655884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.431699038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.431859970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.431866884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.431926966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.448071957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.448092937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.448179007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.448187113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.448259115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.457735062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.457778931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.457828045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.457842112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.457869053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.457911015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.463660955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.463702917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.463745117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.463758945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.463783979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.463826895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.478740931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.478797913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.478830099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.478843927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.478871107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.478892088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.484369993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.484415054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.484453917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.484467030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.484513998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.484513998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.504847050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.504894018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.504950047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.504981995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.505017042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.505042076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.510766983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.510811090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.510858059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.510874033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.510901928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.510921001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.522533894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.522578955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.522643089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.522658110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.522691011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.522711039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.538947105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.538990974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.539048910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.539062977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.539094925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.539114952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.548510075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.548552990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.548638105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.548654079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.548710108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.554419041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.554461956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.554517031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.554531097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.554584026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.554584026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.570813894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.570857048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.570909023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.570921898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.570976973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.570998907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.575134993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.575182915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.575222015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.575233936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.575261116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.575288057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.589963913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.590012074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.590065002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.590086937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.590125084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.590147018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.601509094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.601558924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.601597071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.601623058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.601651907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.601671934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.613034010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.613079071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.613121033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.613137007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.613187075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.613204002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.629590988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.629637003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.629682064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.629697084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.629781008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.629781008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.639144897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.639189959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.639249086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.639262915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.639307022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.639332056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.645209074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.645267010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.645323038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.645337105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.645364046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.645382881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.664699078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.664743900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.664797068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.664809942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.664886951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.664886951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.668061972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.668106079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.668142080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.668173075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.668198109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.668217897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.680828094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.680871010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.680927038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.680939913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.680986881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.681015015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.691708088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.691767931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.691801071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.691812992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.691855907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.691874027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.703814983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.703859091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.703905106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.703917980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.703964949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.704005003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.720602989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.720648050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.720722914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.720735073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.720792055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.720814943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.729928970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.729971886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.730017900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.730029106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.730062962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.730087042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.735950947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.736011982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.736038923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.736049891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.736093998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.736141920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.752145052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.752191067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.752238989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.752253056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.752332926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.752332926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.756542921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.756584883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.756647110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.756659985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.756688118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.756709099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.771363974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.771409988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.771456957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.771469116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.771502018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.771522999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.782521963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.782562017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.782722950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.782737970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.782812119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.794703960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.794745922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.794816017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.794831038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.794864893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.794907093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.811194897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.811244965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.811284065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.811317921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.811342955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.811364889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.820749044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.820810080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.820858002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.820888042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.820916891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.820938110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.826729059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.826780081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.826817989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.826839924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.826867104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.826888084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.843274117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.843326092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.843364954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.843399048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.843425035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.843446970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.847279072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.847327948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.847358942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.847384930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.847418070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.847440958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.862205029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.862255096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.862287045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.862314939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.862339020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.862384081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.873502016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.873568058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.873589039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.873621941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.873655081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.873680115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.885361910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.885422945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.885437012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.885464907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.885495901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.885518074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.902111053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.902154922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.902198076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.902235985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.902268887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.902268887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.902362108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.911400080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.911458969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.911480904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.911513090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.911540985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.911540985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.911571980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.917488098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.917532921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.917576075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.917592049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.917618036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.917637110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.933619022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.933662891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.933700085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.933713913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.933743954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.933763027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.938051939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.938096046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.938134909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.938155890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.938179016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.938199043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.952760935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.952805996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.952857971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.952872038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.952898026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.952941895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.964381933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.964426041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.964467049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.964500904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.964536905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.964557886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.976135015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.976178885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.976219893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.976243973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.976273060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.976305008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.993397951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.993459940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.993555069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.993568897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:39.993637085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:39.993660927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.002898932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.002943039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.003001928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.003019094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.003046036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.003086090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.008181095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.008224964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.008270025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.008284092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.008316040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.008335114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.024543047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.024614096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.024631023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.024643898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.024688959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.024709940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.028733015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.028778076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.028816938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.028831005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.028866053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.028887033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.043519974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.043564081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.043725014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.043745995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.043826103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.055186987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.055234909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.055289984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.055304050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.055350065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.055372000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.067099094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.067143917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.067200899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.067223072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.067272902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.067296028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.083900928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.083945036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.084060907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.084060907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.084079981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.084131956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.093379974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.093425989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.093481064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.093494892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.093544006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.093544006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.098998070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.099040031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.099088907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.099102020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.099148035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.099169016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.115385056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.115444899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.115495920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.115509987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.115535975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.115580082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.119451046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.119493008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.119554996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.119569063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.119599104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.119618893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.134654045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.134700060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.134875059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.134917021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.134979963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.145653963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.145699978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.145746946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.145783901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.145811081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.145832062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.158051014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.158107042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.158144951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.158162117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.158179045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.158205986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.175215960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.175262928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.175308943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.175323963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.175347090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.175396919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.184736967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.184784889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.184834003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.184845924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.184900999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.184911966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.189934015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.189975977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.190018892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.190028906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.190047026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.190071106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.206377983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.206420898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.206569910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.206578970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.206640959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.210572958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.210616112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.210659981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.210668087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.210700035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.210712910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.225517035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.225563049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.225606918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.225615025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.225647926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.225667000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.236450911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.236510038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.236536980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.236543894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.236604929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.236614943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.249109983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.249155045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.249295950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.249326944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.249377012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.268201113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.268243074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.268318892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.268330097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.268398046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.275975943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.276017904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.276067019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.276077032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.276114941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.276129007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.281550884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.281591892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.281630993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.281641006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.281676054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.281701088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.348424911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.348469973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.348556042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.348576069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.348623991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.371336937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.371381998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.371434927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.371443033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.371476889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.371499062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.433506012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.433552027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.433600903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.433614969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.433669090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.437319994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.437361956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.437433004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.437441111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.437477112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.437504053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.457041979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.457083941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.457144976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.457160950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.457206964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.467675924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.467715025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.467767000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.467773914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.467803955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.467830896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.471004009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.471046925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.471107006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.471116066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.471148968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.471174002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.474200010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.474239111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.474287033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.474298000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.474334955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.474358082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.476816893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.476862907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.476891994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.476898909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.476936102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.476967096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.479396105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.479438066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.479475975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.479485989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.479518890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.479542971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.524205923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.524250984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.524310112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.524326086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.524379015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.524419069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.526917934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.526958942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.526988983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.526995897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.527031898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.527049065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.548347950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.548392057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.548451900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.548465967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.548510075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.548530102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.557806015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.557851076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.557894945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.557907104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.557934046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.557960987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.560798883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.560841084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.560903072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.560911894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.560947895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.560965061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.563257933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.563298941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.563345909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.563353062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.563393116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.565016031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.565059900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.565093040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.565100908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.565152884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.569397926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.569453001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.569513083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.569520950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.569571972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.570588112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.614906073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.614952087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.615065098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.615083933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.615169048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.616903067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.616945028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.616991997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.617000103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.617031097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.617050886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.640299082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.640341043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.640403986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.640419006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.640454054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.640477896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.649905920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.649946928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.649992943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.650000095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.650033951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.650063992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.652230978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.652271032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.652364969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.652374029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.652448893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.654627085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.654668093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.654699087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.654711962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.654743910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.654762983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.656054020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.656096935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.656135082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.656141996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.656171083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.656193972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.657787085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.657828093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.657866955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.657875061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.657901049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.657922029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.705765963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.705806971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.706008911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.706022024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.706073999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.707364082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.707405090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.707449913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.707457066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.707501888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.729918957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.729984045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.730022907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.730034113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.730065107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.730089903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.739547968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.739593983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.739646912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.739654064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.739706993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.741332054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.741373062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.741410971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.741419077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.741446972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.741466999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.743256092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.743300915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.743340969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.743349075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.743376970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.743402004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.744985104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.745044947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.745085001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.745091915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.745124102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.745143890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.746165991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.746208906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.746253014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.746259928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.746292114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.746304035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.796745062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.796801090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.796864033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.796874046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.796920061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.796945095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.797753096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.797796965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.797836065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.797842979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.797875881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.797914982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.820702076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.820746899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.820930958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.820930958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.820941925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.820987940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.830244064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.830286026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.830329895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.830337048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.830492973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.830492973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.831288099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.831326962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.831366062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.831372976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.831406116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.831423998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.832896948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.832938910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.832979918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.832987070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.833020926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.833039045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.834619999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.834676981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.834701061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.834707022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.834738970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.834762096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.835602999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.835644960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.835683107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.835690022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.835721970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.835741997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.887427092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.887469053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.887614012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.887614012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.887623072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.887669086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.888394117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.888434887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.888475895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.888488054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.888515949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.888535976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.911392927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.911432981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.911585093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.911585093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.911592960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.911637068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.920758009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.920799971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.920840025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.920846939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.920876980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.920898914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.921978951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.922019005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.922054052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.922060966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.922089100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.922111988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.923604012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.923659086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.923693895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.923701048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.923732042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.923752069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.925321102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.925362110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.925395966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.925403118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.925436020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.925455093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.926191092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.926234007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.926261902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.926274061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.926301956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.926321030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.978461981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.978502989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.978681087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.978681087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.978694916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.978743076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.979221106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.979262114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.979295969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.979302883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:40.979335070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:40.979353905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.002132893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.002175093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.002218962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.002228022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.002393007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.002393007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.011375904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.011420965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.011568069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.011568069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.011579990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.011632919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.012475967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.012552977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.012566090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.012574911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.012605906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.012625933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.014189005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.014231920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.014267921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.014276028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.014306068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.014324903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.015928984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.015969038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.016010046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.016016006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.016047955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.016067028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.016849041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.016890049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.016923904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.016931057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.016962051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.016983032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.069335938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.069381952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.069436073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.069444895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.069500923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.069916010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.069957972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.069998026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.070005894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.070030928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.070056915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.092752934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.092798948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.092852116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.092869043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.092900038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.092921019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.102149963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.102189064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.102248907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.102260113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.102312088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.103643894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.103693008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.103739977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.103748083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.103768110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.103791952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.105041981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.105084896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.105139971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.105149031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.105175018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.105192900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.106843948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.106884956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.106926918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.106935024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.106977940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.107002974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.108062029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.108102083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.108135939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.108144045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.108191967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.108208895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.159890890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.159934998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.159980059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.159995079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.160020113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.160042048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.160718918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.160763025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.160816908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.160824060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.160871983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.183603048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.183648109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.183705091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.183717966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.183754921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.183779001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.192930937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.192970991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.193015099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.193023920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.193062067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.193082094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.194842100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.194881916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.194922924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.194928885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.194966078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.194981098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.196024895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.196065903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.196105003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.196110964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.196144104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.196161032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.197520971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.197565079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.197601080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.197611094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.197643042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.197666883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.198360920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.198400974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.198441029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.198446989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.198473930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.198496103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.250538111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.250580072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.250665903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.250674009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.250706911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.250732899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.251203060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.251245975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.251291990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.251298904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.251329899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.251352072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.274477959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.274535894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.274573088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.274580002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.274612904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.274638891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.283834934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.283905029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.283936977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.283943892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.283977032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.283996105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.285645008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.285686970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.285746098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.285753012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.285804033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.286714077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.286753893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.286794901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.286802053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.286824942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.286847115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.288372993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.288418055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.288454056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.288460016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.288491964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.288506031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.289441109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.289482117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.289514065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.289520979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.289571047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.341877937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.341922045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.341984987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.341998100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.342015028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.342041016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.343014002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.343055010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.343142986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.343152046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.343210936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.365209103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.365248919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.365317106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.365328074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.365374088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.375206947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.375247955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.375289917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.375298023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.375324965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.375344038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.376543999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.376584053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.376616955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.376625061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.376657009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.376679897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.377895117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.377934933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.377979040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.377986908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.378022909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.378040075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.379086971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.379126072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.379160881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.379168034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.379200935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.379220009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.380585909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.380625963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.380660057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.380666018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.380695105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.380717993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.432224989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.432272911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.432327986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.432338953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.432373047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.432393074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.433089018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.433146000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.433166981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.433175087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.433207989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.433227062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.456124067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.456176996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.456345081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.456345081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.456356049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.456401110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.465698957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.465722084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.465795994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.465804100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.465847969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.467026949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.467046022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.467107058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.467113972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.467156887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.468589067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.468609095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.468674898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.468683004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.468725920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.469702959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.469722986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.469785929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.469796896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.469837904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.471034050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.471052885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.471115112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.471122980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.471167088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.523483038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.523503065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.523689032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.523696899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.523751974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.524339914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.524358988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.524432898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.524440050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.524492025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.547849894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.547873020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.547941923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.547950029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.548111916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.556602955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.556624889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.556715012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.556723118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.556775093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.558051109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.558078051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.558146954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.558160067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.558207035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.559272051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.559292078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.559360027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.559367895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.559412956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.560919046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.560940027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.561007023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.561014891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.561058998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.561764956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.561784983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.561851025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.561858892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.561904907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.614308119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.614330053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.614496946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.614506006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.614552975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.615410089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.615437031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.615518093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.615525961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.615578890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.639125109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.639144897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.639218092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.639226913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.639405966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.647222042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.647241116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.647309065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.647316933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.647375107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.648952007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.648972988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.649030924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.649039984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.649076939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.649094105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.650425911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.650445938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.650509119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.650516987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.650572062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.651468992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.651488066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.651551008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.651560068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.651603937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.652689934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.652709007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.652766943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.652775049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.652826071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.705164909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.705204964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.705245018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.705257893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.705291986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.705317974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.705980062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.706000090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.706069946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.706078053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.706124067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.729738951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.729780912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.729821920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.729829073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.729860067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.729887009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.738172054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.738192081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.738259077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.738266945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.738322020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.739849091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.739867926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.739953041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.739960909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.740005016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.740942955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.740963936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.741018057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.741024017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.741056919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.741074085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.742274046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.742295027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.742347002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.742352962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.742389917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.742413044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.743474960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.743495941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.743560076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.743566036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.743609905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.795922995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.795957088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.795998096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.796005964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.796037912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.796056032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.796804905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.796825886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.796891928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.796900034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.796938896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.820810080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.820832014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.820915937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.820930004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.820966959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.830905914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.830925941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.830992937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.831001043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.831041098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.831780910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.831799984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.831866026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.831876040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.831919909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.832854033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.832873106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.832933903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.832947016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.833004951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.833791018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.833810091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.833872080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.833879948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.833924055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.834907055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.834925890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.834985971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.834994078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.835038900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.886856079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.886883974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.887124062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.887134075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.887181044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.887803078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.887825012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.887876034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.887882948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.887917042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.887933016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.911710978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.911731005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.911804914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.911812067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.911968946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.924501896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.924524069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.924699068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.924706936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.924753904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.925581932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.925605059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.925663948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.925672054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.925710917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.926443100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.926464081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.926517963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.926527023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.926542997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.926565886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.927409887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.927429914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.927484989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.927493095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.927531004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.928525925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.928555012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.928611040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.928617954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.928639889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.928658962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.977910042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.977932930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.978094101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.978094101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.978102922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.978144884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.978925943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.978949070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.979012012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:41.979020119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:41.979060888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.003767014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.003789902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.003875017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.003882885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.003895044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.003921986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.015185118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.015206099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.015279055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.015286922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.015444040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.016314030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.016335011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.016380072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.016386986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.016413927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.016422987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.017147064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.017173052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.017226934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.017234087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.017276049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.018222094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.018240929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.018290997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.018297911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.018326998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.018340111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.019151926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.019171000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.019213915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.019221067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.019244909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.019263029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.068609953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.068633080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.068677902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.068692923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.068721056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.068732023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.069494009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.069514036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.069549084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.069555998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.069585085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.069591045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.094675064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.094696045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.094738960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.094746113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.094773054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.094790936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.105998039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.106019020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.106072903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.106080055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.106115103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.106128931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.107186079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.107212067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.107259989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.107266903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.107295036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.107314110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.108087063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.108107090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.108149052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.108156919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.108182907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.108196020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.109308004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.109334946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.109371901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.109378099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.109405041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.109419107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.110063076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.110085964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.110121965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.110127926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.110148907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.110166073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.159483910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.159506083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.159549952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.159558058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.159584045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.159601927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.160562038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.160582066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.160624027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.160633087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.160650969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.160669088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.185533047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.185554981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.185607910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.185615063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.185652971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.185671091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.196882010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.196902990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.196952105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.196959972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.196985960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.197000980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.198621035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.198640108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.198685884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.198693991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.198717117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.198729992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.199315071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.199333906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.199382067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.199389935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.199409962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.199424028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.200589895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.200613976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.200666904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.200673103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.200695992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.200719118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.201417923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.201436996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.201487064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.201494932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.201535940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.250082016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.250104904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.250303030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.250313044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.250371933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.253902912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.253925085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.253983021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.253990889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.254033089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.276612043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.276654005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.276691914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.276702881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.276719093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.276742935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.288223982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.288264036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.288403988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.288403988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.288412094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.288456917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.289305925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.289346933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.289381027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.289386988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.289408922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.289431095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.290118933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.290172100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.290201902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.290209055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.290237904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.290246010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.291551113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.291593075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.291624069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.291630983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.291666031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.291677952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.291743994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.291790009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.291829109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.291836023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.291848898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.291874886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.340923071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.340965033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.341018915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.341029882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.341048956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.341070890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.344690084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.344732046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.344763994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.344773054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.344801903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.344821930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.367291927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.367333889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.367372990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.367383003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.367414951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.367428064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.378518105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.378559113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.378588915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.378596067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.378616095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.378628016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.380286932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.380326033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.380372047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.380378962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.380407095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.380424976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.380882978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.380925894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.380956888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.380964041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.380985022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.381006002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.382030010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.382069111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.382108927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.382116079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.382137060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.382152081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.382919073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.382957935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.382988930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.382994890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.383022070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.383034945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.432244062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.432286978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.432336092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.432343960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.432512999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.432512999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.435463905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.435504913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.435542107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.435549021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.435568094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.435590982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.458075047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.458120108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.458173990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.458184958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.458214998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.458229065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.469830990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.469872952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.469914913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.469921112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.470083952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.470083952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.470794916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.470848083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.470889091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.470896006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.470921993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.470936060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.471637011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.471681118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.471714020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.471719980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.471748114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.471759081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.472678900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.472721100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.472754955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.472762108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.472790956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.472798109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.473552942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.473592043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.473625898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.473632097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.473649979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.473678112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.526731968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.526774883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.526952982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.526959896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.527007103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.528356075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.528395891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.528433084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.528439999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.528470993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.528487921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.548757076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.548806906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.548862934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.548870087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.548888922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.548908949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.560733080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.560791016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.560831070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.560837984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.560988903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.560988903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.561810017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.561850071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.561891079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.561897993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.561916113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.561935902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.562592030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.562635899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.562668085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.562674046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.562695980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.562716007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.563533068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.563575029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.563602924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.563610077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.563627958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.563644886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.564325094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.564366102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.564400911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.564408064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.564435005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.564454079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.617875099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.617923975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.617961884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.617978096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.618000984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.618016958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.619668007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.619710922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.619749069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.619761944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.619788885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.619808912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.640155077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.640197039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.640232086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.640242100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.640269995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.640285015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.651391029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.651448965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.651495934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.651508093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.651537895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.651556969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.652348995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.652393103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.652424097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.652431011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.652463913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.652472019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.653348923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.653392076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.653422117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.653429031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.653460979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.653475046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.654225111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.654267073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.654294968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.654301882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.654325962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.654342890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.654853106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.654896021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.654921055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.654927969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.654957056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.654966116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.710022926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.710066080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.710120916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.710134029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.710175037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.710184097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.710786104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.710827112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.710864067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.710870981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.710905075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.710918903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.731955051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.731996059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.732073069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.732084036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.732122898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.732141972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.744761944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.744805098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.744854927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.744863033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.744899988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.744909048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.745654106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.745693922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.745744944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.745752096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.745774031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.745789051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.746203899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.746243954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.746273994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.746279955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.746308088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.746325970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.749320030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.749361038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.749394894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.749402046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.749433041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.749443054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.750406027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.750446081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.750468969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.750474930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.750504017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.750514984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.806077003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.806122065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.806176901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.806188107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.806222916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.806236982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.806893110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.806937933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.806963921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.806971073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.806999922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.807008982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.834028959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.834094048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.834170103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.834177971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.834209919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.834228039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.838885069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.838933945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.838973045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.838979959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.839014053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.839027882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.839427948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.839474916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.839493036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.839500904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.839525938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.839533091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.840228081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.840267897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.840289116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.840295076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.840318918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.840336084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.840763092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.840806007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.840828896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.840835094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.840861082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.840876102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.841550112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.841592073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.841619968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.841625929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.841655016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.841672897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.896576881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.896620989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.896670103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.896683931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.896713972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.896733046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.897444010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.897461891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.897531033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.897538900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.897578955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.924624920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.924645901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.924704075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.924711943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.924745083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.924757957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.933881044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.933902025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.933979034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.933986902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.934030056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.934537888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.934557915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.934600115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.934607983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.934623957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.934654951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.935345888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.935369968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.935410976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.935419083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.935444117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.935456991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.936311007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.936331987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.936372042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.936378956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.936403036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.936422110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.937145948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.937166929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.937206984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.937212944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.937242985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.937257051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.987536907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.987564087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.987618923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.987627029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.987668991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.988106966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.988135099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.988204002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:42.988212109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:42.988250971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.015707016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.015727997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.015780926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.015789986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.015832901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.025510073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.025528908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.025599003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.025607109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.025648117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.025866032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.025887966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.025926113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.025933027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.025959969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.025971889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.027287006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.027306080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.027368069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.027374983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.027420044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.028170109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.028189898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.028242111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.028249025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.028289080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.028956890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.028976917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.029028893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.029035091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.029077053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.078182936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.078205109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.078263998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.078279018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.078327894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.078327894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.105879068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.105899096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.105998039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.106005907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.106049061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.115654945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.115675926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.115748882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.115757942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.115801096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.116400957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.116420984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.116491079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.116497993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.116539955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.117207050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.117228031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.117291927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.117299080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.117338896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.117963076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.117984056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.118042946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.118051052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.118091106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.119044065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.119071960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.119112968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.119119883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.119148016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.119162083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.119899988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.119920969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.119977951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.119986057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.120022058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.169547081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.169575930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.169627905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.169634104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.169660091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.169672966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.196963072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.196984053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.197058916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.197067976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.197119951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.206392050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.206410885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.206475973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.206484079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.206526041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.207099915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.207119942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.207182884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.207190990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.207237005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.208235025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.208256006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.208317041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.208323956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.208364964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.209088087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.209106922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.209167957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.209176064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.209217072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.209886074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.209906101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.209960938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.209969044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.210009098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.210913897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.210933924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.210983038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.210989952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.211011887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.211025000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.259669065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.259691000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.259778023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.259789944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.259834051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.289767027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.289787054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.289866924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.289875031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.289922953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.297266006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.297291994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.297353983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.297360897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.297405958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.298027992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.298047066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.298103094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.298110008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.298156023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.298708916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.298729897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.298784971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.298793077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.298830986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.299678087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.299700975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.299750090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.299757004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.299796104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.300662994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.300683975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.300733089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.300740004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.300757885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.300776005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.301637888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.301664114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.301709890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.301717997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.301740885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.301754951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.350622892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.350646019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.350727081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.350734949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.350778103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.386234045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.386254072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.386323929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.386332989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.386377096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.393846035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.393887997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.393927097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.393934011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.393965006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.393974066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.395184994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.395204067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.395267010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.395273924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.395291090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.395314932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.396306038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.396326065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.396394014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.396400928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.396442890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.397443056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.397464037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.397541046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.397548914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.397588968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.398212910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.398231983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.398288012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.398296118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.398305893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.398339987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.399379969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.399399042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.399454117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.399461031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.399501085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.441344023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.441365004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.441447020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.441458941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.441504955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.476670980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.476692915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.476753950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.476767063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.476797104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.476813078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.485544920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.485565901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.485610962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.485618114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.485646009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.485656023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.486803055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.486823082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.486864090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.486871004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.486902952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.486911058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.487363100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.487385035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.487418890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.487426043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.487447977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.487464905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.488727093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.488746881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.488784075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.488791943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.488820076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.488831997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.489392042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.489418983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.489468098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.489475012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.489502907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.489520073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.490185022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.490206003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.490248919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.490255117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.490283012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.490297079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.532186031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.532212973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.532372952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.532381058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.532428026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.570719957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.570743084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.570781946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.570790052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.570817947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.570836067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.576193094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.576212883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.576256037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.576263905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.576288939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.576302052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.577812910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.577835083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.577878952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.577886105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.577913046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.577925920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.578725100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.578747034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.578780890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.578788042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.578820944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.578838110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.579421043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.579440117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.579482079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.579488039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.579520941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.579530001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.579963923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.579983950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.580037117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.580044031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.580070972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.580085993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.581497908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.581517935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.581578016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.581584930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.581623077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.581641912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.623550892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.623577118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.623620987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.623627901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.623657942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.623676062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.666668892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.666688919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.666750908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.666788101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.666805029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.666835070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.669326067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.669347048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.669390917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.669399023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.669424057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.669445038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.670088053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.670109034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.670156956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.670166016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.670178890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.670209885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.670831919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.670850992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.670895100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.670903921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.670928001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.670938969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.671606064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.671632051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.671683073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.671691895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.671711922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.671730042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.672652960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.672673941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.672729969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.672739983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.672781944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.673506975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.673526049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.673571110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.673578978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.673626900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.714246988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.714266062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.714344025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.714355946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.714381933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.714392900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.757328033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.757349014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.757436991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.757451057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.757502079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.759887934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.759907007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.759963989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.759974957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.760019064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.761065960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.761086941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.761145115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.761162996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.761209965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.761538029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.761557102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.761615038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.761625051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.761688948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.762835979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.762855053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.762919903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.762928963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.762970924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.763307095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.763329029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.763381958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.763391972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.763433933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.764286995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.764306068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.764367104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.764381886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.764421940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.804871082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.804898024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.804991961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.805001974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.805053949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.848452091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.848475933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.848572969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.848608017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.848655939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.851146936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.851165056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.851233006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.851243019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.851281881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.851929903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.851949930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.852010965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.852019072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.852062941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.852994919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.853018999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.853075027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.853085041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.853101969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.853122950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.853662014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.853682995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.853751898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.853760958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.853805065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.854440928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.854460955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.854518890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.854527950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.854568958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.855262041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.855282068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.855343103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.855350971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.855389118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.903532028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.903553009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.903631926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.903644085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.903670073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.903688908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.939220905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.939244032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.939308882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.939317942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.939361095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.941762924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.941782951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.941857100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.941864967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.941907883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.942586899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.942606926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.942662954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.942672014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.942709923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.943331957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.943351984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.943406105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.943422079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.943464041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.944385052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.944403887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.944457054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.944466114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.944504976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.945193052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.945213079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.945267916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.945276976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.945316076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.945887089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.945907116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.945962906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.945977926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.946019888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.994401932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.994424105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.994509935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:43.994544983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:43.994592905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.031919003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.031941891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.032028913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.032038927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.032083035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.033698082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.033719063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.033785105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.033793926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.033838987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.034590960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.034624100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.034688950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.034698009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.034744024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.035657883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.035677910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.035751104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.035759926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.035801888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.035979986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.036005974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.036041975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.036051989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.036075115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.036093950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.036956072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.036976099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.037019968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.037029028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.037054062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.037070990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.037775993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.037797928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.037851095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.037859917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.037897110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.088175058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.088196039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.088289976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.088315964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.088365078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.122905970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.122927904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.123111963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.123121023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.123167038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.124526978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.124547005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.124608994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.124617100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.124658108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.125309944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.125329018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.125389099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.125397921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.125439882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.126115084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.126133919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.126193047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.126203060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.126244068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.126801968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.126820087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.126889944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.126899004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.126941919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.127573967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.127593040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.127671957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.127681017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.127726078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.128381014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.128402948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.128449917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.128458023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.128487110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.128499985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.178920984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.178945065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.178987980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.178997040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.179033995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.179064035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.213501930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.213546991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.213582993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.213592052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.213612080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.213622093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.215004921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.215033054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.215081930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.215091944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.215122938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.215133905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.215850115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.215873957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.215934038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.215943098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.215992928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.216737032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.216757059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.216814041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.216823101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.216864109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.217515945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.217535019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.217587948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.217597961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.217612982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.217629910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.218270063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.218291998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.218352079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.218360901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.218405008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.219351053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.219372034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.219413996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.219422102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.219436884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.219460964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.269889116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.269913912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.270029068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.270039082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.270108938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.304754972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.304779053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.304914951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.304928064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.304976940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.305710077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.305730104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.305804968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.305814028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.305883884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.306785107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.306804895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.306869030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.306878090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.306922913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.307571888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.307593107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.307651043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.307660103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.307704926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.308604002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.308623075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.308685064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.308692932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.308738947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.309276104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.309294939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.309362888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.309372902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.309417009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.310048103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.310066938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.310123920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.310132980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.310197115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.310197115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.360625982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.360650063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.360769987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.360780001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.360833883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.395284891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.395317078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.395437956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.395466089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.395546913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.396394968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.396414042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.396498919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.396506071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.396553040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.397207022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.397228003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.397316933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.397325039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.397372007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.398262978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.398284912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.398363113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.398370028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.398418903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.398940086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.398962975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.399036884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.399044991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.399089098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.399754047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.399772882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.399844885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.399852991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.399900913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.400661945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.400682926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.400787115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.400794983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.400863886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.451369047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.451394081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.451692104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.451699972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.451901913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.486025095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.486048937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.486217976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.486227036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.486309052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.487221956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.487242937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.487327099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.487335920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.487382889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.488090038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.488110065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.488178015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.488185883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.488235950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.488734961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.488756895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.488826990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.488835096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.488879919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.489841938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.489862919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.489929914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.489937067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.489986897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.490499973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.490518093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.490586042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.490592957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.490641117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.491410971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.491432905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.491498947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.491506100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.491553068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.542304993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.542335033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.542504072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.542529106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.542581081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.576771021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.576792002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.576910973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.576919079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.577003956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.577810049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.577830076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.577904940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.577910900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.577956915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.578669071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.578689098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.578748941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.578756094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.578788996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.578809977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.579683065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.579700947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.579773903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.579780102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.579824924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.580424070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.580444098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.580527067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.580533981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.580580950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.581152916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.581171989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.581232071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.581239939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.581285000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.582041025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.582060099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.582123041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.582130909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.582175016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.633040905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.633105993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.633177042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.633184910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.633261919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.667721033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.667769909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.667835951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.667844057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.667903900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.667926073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.668642044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.668684959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.668725014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.668731928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.668764114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.668792009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.669478893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.669519901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.669555902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.669563055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.669595957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.669616938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.670181036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.670222044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.670262098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.670268059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.670306921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.670330048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.670968056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.671008110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.671051025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.671056986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.671086073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.671111107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.671843052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.671883106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.671924114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.671930075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.671963930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.671986103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.672665119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.672719002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.672760963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.672768116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.672801971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.672823906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.723793030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.723839998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.723905087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.723912954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.723989964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.758341074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.758384943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.758428097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.758434057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.758516073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.758544922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.759363890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.759407043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.759483099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.759489059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.759520054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.759532928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.760137081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.760179043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.760227919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.760234118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.760272026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.760296106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.761109114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.761147976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.761195898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.761203051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.761236906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.761306047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.761734009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.761778116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.761823893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.761831045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.761864901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.761883020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.762332916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.762372017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.762412071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.762418985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.762473106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.763261080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.763300896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.763340950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.763351917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.763374090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.763398886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.814585924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.814630032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.814690113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.814697027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.814774036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.849311113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.849361897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.849417925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.849426985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.849457979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.849482059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.850126028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.850183964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.850210905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.850219965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.850260973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.850275993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.850838900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.850918055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.850920916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.850954056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.850991011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.851013899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.851639986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.851682901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.851752043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.851761103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.851811886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.852596998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.852638006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.852674007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.852683067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.852710009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.852730989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.853188038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.853260040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.853286982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.853293896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.853331089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.853353024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.853965044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.854008913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.854048967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.854055882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.854099989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.905599117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.905646086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.905847073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.905858040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.905900002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.944463015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.944520950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.944598913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.944606066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.944664001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.945173025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.945250034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.945250988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.945277929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.945317984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.945343018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.945880890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.945921898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.945962906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.945970058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.945997000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.946027994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.946779013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.946821928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.946856976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.946863890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.946896076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.946918011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.947792053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.947830915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.947866917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.947873116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.947911978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.947932005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.948681116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.948719978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.948755026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.948761940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.948793888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.948820114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.949373960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.949414968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.949459076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.949465990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.949495077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.949512005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.996171951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.996215105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.996304035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:44.996310949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:44.996377945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.035454988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.035495996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.035564899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.035572052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.035634041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.035969019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.036041975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.036048889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.036067009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.036103964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.036132097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.036623955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.036664009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.036706924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.036714077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.036758900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.037734032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.037775040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.037813902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.037821054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.037866116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.038649082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.038702011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.038739920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.038746119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.038770914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.038796902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.038841963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.038883924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.038908005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.038913965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.038949013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.038971901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.039823055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.039864063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.039901018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.039906979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.039943933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.039962053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.086874008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.086919069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.087127924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.087136030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.087291956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.127979994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.128024101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.128072977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.128081083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.128133059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.128742933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.128782988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.128817081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.128823996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.128853083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.128880024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.129699945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.129740000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.129828930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.129836082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.129880905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.130342960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.130386114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.130418062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.130425930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.130458117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.130481005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.131294012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.131337881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.131375074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.131381035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.131427050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.132116079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.132155895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.132195950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.132203102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.132229090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.132256985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.133447886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.133491039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.133593082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.133600950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.133645058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.177629948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.177676916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.177762985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.177769899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.177916050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.218776941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.218844891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.218965054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.218971968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.219120026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.219495058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.219533920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.219563007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.219568968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.219599009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.219625950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.220316887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.220359087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.220385075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.220391035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.220424891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.220451117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.221724033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.221781969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.221816063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.221822977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.221853018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.221874952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.221920967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.221962929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.221992016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.221997976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.222034931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.222059965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.222809076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.222852945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.222898006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.222903967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.222954988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.224229097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.224272966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.224329948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.224335909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.224368095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.224391937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.268342018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.268384933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.268537045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.268537045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.268547058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.268702984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.309675932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.309720993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.309789896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.309798956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.309839964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.309866905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.310359955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.310401917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.310441017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.310446978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.310497999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.311120033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.311162949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.311197042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.311203957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.311233997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.311259031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.312035084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.312076092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.312107086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.312113047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.312145948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.312170029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.312460899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.312519073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.312527895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.312546968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.312581062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.312603951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.313589096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.313628912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.313661098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.313668013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.313703060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.313725948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.315155983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.315198898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.315228939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.315234900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.315268993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.315293074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.359074116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.359116077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.359260082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.359260082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.359267950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.359313011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.400259018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.400316000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.400361061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.400367975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.400523901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.400979042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.401035070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.401050091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.401058912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.401098013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.401119947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.401894093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.401947021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.401974916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.401982069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.402019024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.402044058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.402637005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.402713060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.402720928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.402739048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.402771950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.402797937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.403610945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.403651953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.403691053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.403697014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.403728962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.403752089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.404396057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.404450893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.404463053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.404475927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.404510975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.404536009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.406083107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.406124115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.406152964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.406158924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.406197071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.406223059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.449841976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.449888945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.450006008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.450012922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.450076103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.490957022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.491005898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.491182089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.491182089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.491189003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.491235018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.491770029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.491811037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.491849899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.491856098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.491913080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.492666960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.492710114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.492748976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.492755890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.492784977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.492810965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.493283033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.493321896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.493355036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.493362904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.493403912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.493426085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.494087934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.494128942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.494162083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.494168997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.494210958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.494235039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.495003939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.495043993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.495078087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.495085955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.495125055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.495148897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.496813059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.496854067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.496895075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.496901989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.496978045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.540720940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.540770054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.540807962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.540817022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.540882111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.582006931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.582048893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.582103968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.582110882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.582148075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.582175970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.583199978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.583254099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.583288908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.583296061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.583326101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.583349943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.584088087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.584129095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.584163904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.584171057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.584217072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.584875107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.584920883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.584959984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.584966898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.584997892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.585027933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.585630894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.585670948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.585696936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.585702896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.585726976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.585748911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.586172104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.586210012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.586246014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.586251974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.586292982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.586319923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.588007927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.588047981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.588083982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.588089943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.588131905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.631453991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.631495953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.631535053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.631541014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.631577969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.631603956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.673192978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.673259020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.673300982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.673307896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.673369884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.673965931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.674010992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.674050093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.674057007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.674099922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.674823046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.674864054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.674902916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.674910069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.674918890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.674954891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.675607920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.675652981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.675693989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.675700903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.675740004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.676151037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.676196098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.676233053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.676239967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.676306009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.676306009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.677076101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.677119970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.677159071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.677165985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.677213907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.678621054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.678664923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.678714037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.678720951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.678749084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.678777933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.722033024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.722076893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.722110033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.722119093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.722148895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.722174883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.763761997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.763820887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.763874054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.763881922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.763910055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.763938904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.764552116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.764597893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.764626026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.764632940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.764668941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.764688969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.765278101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.765336990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.765347004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.765367985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.765386105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.765415907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.766251087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.766294956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.766319990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.766326904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.766355038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.766377926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.766839027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.766880989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.766906977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.766912937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.766943932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.766973019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.767580986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.767621994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.767647028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.767653942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.767685890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.767703056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.769572020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.769610882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.769649029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.769655943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.769695997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.812807083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.812855005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.812916040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.812922955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.812990904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.854615927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.854682922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.854830027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.854830027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.854840040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.854887009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.855623007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.855664968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.855710983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.855716944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.855762005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.856353998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.856393099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.856441975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.856452942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.856478930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.856501102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.857116938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.857156992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.857201099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.857207060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.857250929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.857752085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.857794046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.857831001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.857837915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.857863903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.857883930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.858521938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.858562946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.858607054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.858613014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.858652115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.858675003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.860203028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.860243082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.860284090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.860290051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.860342026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.905709982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.905771017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.905958891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.905958891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.905966997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.906012058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.945157051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.945204020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.945358992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.945358992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.945368052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.945415020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.946124077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.946166039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.946206093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.946213007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.946258068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.947005987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.947046995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.947086096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.947093010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.947154999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.947154999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.947664976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.947735071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.947750092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.947757959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.947789907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.947815895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.948623896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.948663950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.948710918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.948717117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.948767900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.949556112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.949595928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.949635029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.949641943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.949672937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.949700117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.950819016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.950860023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.950897932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.950905085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.950946093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.950973034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.996143103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.996186972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.996251106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:45.996258974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:45.996409893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.038551092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.038628101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.038746119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.038747072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.038753986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.038801908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.039136887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.039176941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.039206982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.039212942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.039263964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.040133953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.040174961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.040314913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.040348053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.040380001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.040417910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.040462971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.041368961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.041410923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.041454077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.041461945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.041503906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.042315960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.042356968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.042402029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.042408943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.042434931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.042467117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.043385029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.043437958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.043481112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.043488026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.043523073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.043545961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.086786032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.086829901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.086886883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.086895943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.086949110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.130723000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.130768061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.130844116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.130852938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.130872965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.130908966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.131263971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.131306887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.131335974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.131342888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.131373882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.131395102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.132265091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.132304907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.132337093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.132344961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.132389069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.132453918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.132514000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.132515907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.132544041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.132577896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.132599115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.133462906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.133502007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.133539915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.133547068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.133591890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.133599043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.134224892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.134265900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.134294033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.134299994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.134345055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.134351969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.134994984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.135036945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.135072947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.135080099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.135116100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.135139942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.186136007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.186180115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.186232090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.186238050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.186290979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.221419096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.221462011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.221501112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.221508026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.221560001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.222063065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.222104073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.222130060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.222136974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.222186089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.222212076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.222882032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.222919941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.222966909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.222973108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.223015070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.223042011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.223453045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.223495007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.223524094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.223530054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.223578930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.224281073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.224323034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.224361897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.224369049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.224395037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.224420071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.225276947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.225330114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.225367069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.225373030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.225408077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.225430012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.225910902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.225984097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.226016045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.226022005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.226032019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.226064920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.276777983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.276827097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.276889086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.276896000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.277048111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.533163071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533204079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533255100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533301115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.533335924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533482075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.533482075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.533643961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533688068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533725023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.533734083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.533771992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.533798933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.534306049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.534348965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.534383059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.534390926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.534423113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.534447908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.535212040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.535265923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.535303116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.535310984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.535342932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.535363913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.536170959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.536217928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.536257029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.536264896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.536299944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.536323071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.536391973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.536433935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.536470890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.536478996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.536509991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.536536932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.537379026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.537426949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.537465096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.537472963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.537503958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.537528038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.538299084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.538352966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.538388968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.538398981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.538434029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.538460016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.539134026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.539175987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.539212942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.539221048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.539252996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.539277077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.539874077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.539921999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.539954901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.539963007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.540002108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.540024996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.540079117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.540122032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.540154934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.540163040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.540196896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.540222883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.541104078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.541146994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.541184902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.541192055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.541220903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.541246891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.541748047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.541793108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.541829109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.541836977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.541867971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.541889906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.542093992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.542141914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.542175055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.542182922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.542213917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.542239904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.542283058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.542325020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.542362928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.542371035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.542395115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.542423964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.543088913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.543138981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.543183088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.543191910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.543215036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.543237925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.543869972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.543916941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.543952942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.543967009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.543996096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.544018984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.544389963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.544437885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.544475079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.544490099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.544514894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.544542074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545341015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545382023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545419931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545428038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545456886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545485973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545485973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545517921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545552969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545567036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545592070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545599937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.545631886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.545663118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.546344042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.546392918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.546431065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.546438932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.546469927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.546494961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.546669006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.546709061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.546736002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.546744108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.546776056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.546798944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.547363997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.547405005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.547440052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.547447920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.547475100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.547498941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.556638002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.556687117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.556723118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.556730986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.556761980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.556792974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.591298103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.591351032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.591423988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.591432095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.591590881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.591737986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.591784954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.591815948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.591824055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.591846943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.591876030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.592299938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.592341900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.592381954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.592395067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.592422962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.592446089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.592930079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.592972040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.593012094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.593019962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.593071938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.593635082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.593676090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.593738079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.593745947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.593759060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.593791962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.594191074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.594239950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.594280958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.594288111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.594326019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.594351053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.594629049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.594685078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.594719887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.594727993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.594767094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.594789982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.647252083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.647320986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.647496939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.647496939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.647506952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.647557020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.682023048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.682101965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.682140112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.682147980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.682207108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.682411909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.682451963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.682493925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.682501078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.682533979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.682555914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.682998896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.683022022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.683092117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.683101892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.683151007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.683602095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.683623075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.683682919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.683691978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.683741093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.684389114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.684422016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.684468031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.684475899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.684504032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.684531927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.684824944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.684844971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.684907913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.684917927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.684959888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.685429096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.685448885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.685514927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.685523033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.685565948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.738318920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.738363981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.738528967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.738528967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.738542080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.738688946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.772836924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.772883892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773078918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773078918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773087025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773133993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773171902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773224115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773257971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773267031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773298979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773324966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773812056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773859978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773900032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.773907900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.773962021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.774319887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.774370909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.774419069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.774426937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.774454117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.774478912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.775108099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.775211096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.775254965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.775269032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.775301933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.775325060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.775660992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.775717974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.775751114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.775759935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.775804043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.775821924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.776318073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.776362896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.776407957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.776416063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.776448965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.776475906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.829108000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.829186916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.829212904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.829221010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.829258919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.829282999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.863506079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.863550901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.863600969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.863610029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.863636017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.863662958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.864053965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.864098072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.864130974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.864139080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.864172935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.864192963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.864717960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.864762068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.864797115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.864804983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.864837885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.864862919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.865252018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.865292072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.865331888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.865339994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.865377903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.865401030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.865844965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.865899086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.865936995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.865945101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.865993023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.866378069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.866420031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.866458893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.866466045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.866492987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.866519928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.867074013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.867115021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.867156982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.867171049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.867198944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.867221117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.921001911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.921052933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.921113014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.921120882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.921181917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.954302073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.954349995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.954526901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.954539061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.954587936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.954864025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.954904079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.954946995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.954955101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.954989910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.955013037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.955276966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.955317974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.955352068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.955358982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.955391884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.955419064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.955884933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.955926895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.955960035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.955967903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.955996990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.956026077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.956540108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.956589937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.956624031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.956631899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.956665993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.956696987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.957021952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.957063913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.957101107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.957108974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.957135916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.957163095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.957863092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.957905054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.957962036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.957988977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:46.958193064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:46.958193064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.012312889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.012353897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.012504101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.012504101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.012520075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.012564898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.045036077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.045094013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.045241117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.045268059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.045346022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.045531988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.045572996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.045623064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.045629978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.045684099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.046145916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.046185970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.046224117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.046231031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.046257973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.046278000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.046777010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.046821117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.046857119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.046864986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.046894073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.046917915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.047357082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.047399044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.047431946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.047440052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.047463894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.047483921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.047879934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.047920942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.047955036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.047961950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.047995090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.048017025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.048563004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.048604012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.048640966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.048648119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.048675060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.048702002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.103050947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.103125095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.103178024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.103184938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.103239059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.350893021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.350927114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.350976944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.351130962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.351131916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.351171017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.351193905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.351284981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.351629019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.351672888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.351710081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.351727009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.351756096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.351787090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352505922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352560997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352590084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352597952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352631092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352657080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352663994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352693081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352726936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352739096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352761030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352770090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.352802992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.352834940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.353496075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.353538036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.353576899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.353584051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.353621960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.353642941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.354027987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.354070902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.354109049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.354116917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.354151011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.354181051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.354353905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.354402065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.354438066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.354446888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.354480028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.354504108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.355289936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.355330944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.355365038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.355372906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.355407000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.355431080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.355972052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356013060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356060028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356069088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356095076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356125116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356336117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356379986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356416941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356425047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356456995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356487036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356570005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356622934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356661081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356667995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.356703043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.356731892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.357906103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.357947111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.357980967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.357989073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358020067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358045101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358156919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358205080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358237028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358243942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358279943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358298063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358335018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358383894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358421087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358428001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358459949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358484030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358503103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358560085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358591080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358598948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.358633995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.358653069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.359246016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.359296083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.359330893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.359338045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.359369993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.359394073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.359730005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.359781027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.359814882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.359822989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.359859943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.359886885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.360110998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.360152960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.360189915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.360197067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.360229015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.360254049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.360995054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361042023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361073971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361082077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361145973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361146927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361172915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361207962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361218929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361232996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361243963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361285925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361319065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361803055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361846924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361888885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.361896992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.361943960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.371023893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.371072054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.371119022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.371126890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.371149063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.371175051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.375349045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.375395060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.375430107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.375437021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.375473976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.375502110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.413335085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.413378954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.413440943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.413449049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.413604021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.413945913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.413989067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.414021969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.414028883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.414043903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.414077044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.414397955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.414441109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.414475918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.414484024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.414518118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.414545059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.415107965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.415163040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.415199995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.415213108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.415242910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.415266991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.415318012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.415364027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.415386915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.415395021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.415427923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.415456057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.416019917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.416060925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.416093111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.416100025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.416134119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.416157007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.462088108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.462142944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.462183952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.462192059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.462232113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.462268114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.466469049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.466512918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.466553926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.466562033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.466608047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.504384041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.504426956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.504479885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.504492998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.504534006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.504555941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.504914999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.504956007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.504983902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.504991055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.505026102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.505047083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.505438089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.505476952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.505510092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.505517006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.505549908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.505573034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.505990028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506031990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506064892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506072998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506128073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506544113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506584883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506640911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506649017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506686926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506709099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506774902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506820917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506855965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506864071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.506895065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.506920099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.552733898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.552781105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.552822113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.552831888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.552866936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.552894115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.557094097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.557135105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.557183027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.557190895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.557241917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.595643997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.595686913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.595757008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.595767021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.595833063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596101046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596158028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596175909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596184015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596220970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596245050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596352100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596391916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596421003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596429110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596461058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596493959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596887112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596927881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.596956968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.596965075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597002029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597023964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597585917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597625971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597656965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597664118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597695112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597719908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597852945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597907066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597933054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597946882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.597974062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.597997904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.643712997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.643768072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.643949032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.643949032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.643959045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.644006968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.647907019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.647953033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.648010969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.648019075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.648078918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.686012983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.686060905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.686106920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.686115026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.686176062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.686686993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.686731100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.686774969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.686783075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.686810017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.686840057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687108994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687149048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687182903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687190056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687225103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687246084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687553883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687593937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687628031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687634945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687674046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687699080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687814951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687856913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687886000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687894106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.687925100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.687954903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.688702106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.688745022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.688779116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.688786983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.688817024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.688842058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.734344006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.734385014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.734436989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.734446049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.734507084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.738692045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.738754988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.738790035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.738801003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.738830090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.738850117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777071953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777112961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777167082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777174950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777234077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777313948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777354002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777420044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777427912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777456045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777481079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777631998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777672052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777700901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777709007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.777746916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.777772903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.778393030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.778433084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.778476000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.778482914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.778527975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.778553009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.778717041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.778774023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.778806925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.778815031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.778855085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.778881073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.779095888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.779138088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.779172897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.779180050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.779213905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.779238939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.825186968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.825252056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.825310946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.825319052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.825382948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.829839945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.829881907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.829926014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.829933882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.829972982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.829992056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.867602110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.867649078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.867731094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.867748022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.867796898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.867820024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.868068933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.868109941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.868140936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.868149042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.868185997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.868216991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.868669033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.868710041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.868745089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.868752956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.868784904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.868812084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.869237900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.869278908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.869308949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.869317055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.869381905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.869381905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.869930983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.869970083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.870008945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.870017052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.870048046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.870060921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.870105028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.870146036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.870174885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.870183945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.870213985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.870235920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.916399002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.916472912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.916524887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.916532993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.916587114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.920736074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.920793056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.920834064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.920841932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.920881987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.920905113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.958983898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959031105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959116936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959127903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959191084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959259033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959297895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959328890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959336042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959352970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959386110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959753990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959795952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959827900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959835052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.959871054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.959894896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.960309982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.960366964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.960400105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.960407972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.960442066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.960463047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.960828066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.960877895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.960907936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.960916042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.960942984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.960971117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.961477041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.961532116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.961565971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.961572886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:47.961600065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:47.961622953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.008358955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.008421898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.008522034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.008531094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.008585930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.011631966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.011677027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.011728048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.011735916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.011763096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.011795044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.049597025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.049639940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.049714088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.049721003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.049757957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.049782038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.050034046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.050076008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.050112009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.050117970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.050148964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.050169945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.050626993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.050667048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.050700903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.050708055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.050734997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.050757885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.051110029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.051148891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.051178932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.051189899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.051223993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.051244020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.051618099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.051657915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.051681042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.051687002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.051728010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.051745892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.052050114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.052093029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.052124977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.052131891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.052160978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.052184105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.099396944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.099438906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.099479914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.099487066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.099548101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.102593899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.102632999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.102669001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.102674961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.102718115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.102739096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.140796900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.140841961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.140878916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.140886068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.140934944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.141232014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.141272068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.141303062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.141310930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.141321898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.141350985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.141812086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.141869068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.141896009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.141901970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.141938925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.141962051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.142219067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.142260075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.142292976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.142298937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.142354965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.142379999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.142688990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.142730951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.142764091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.142770052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.142802954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.142824888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.143316031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.143356085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.143377066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.143383980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.143418074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.143448114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.190299988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.190344095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.190382957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.190391064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.190607071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.193424940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.193465948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.193502903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.193507910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.193542957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.193563938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.231482029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.231528044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.231654882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.231654882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.231662035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.231755972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.232027054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.232065916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.232095957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.232103109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.232156038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.232379913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.232419968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.232443094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.232450008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.232492924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.232511044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.232994080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.233031988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.233076096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.233083010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.233125925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.235358953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.235400915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.235440016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.235445976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.235493898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.235791922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.235831976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.235863924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.235869884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.235898972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.235918045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.284220934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.284265995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.284333944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.284346104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.284379005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.284403086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.286021948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.286066055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.286120892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.286128998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.286190987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.323627949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.323674917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.323823929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.323823929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.323831081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.323877096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.323884964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.323929071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.323964119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.323982000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324002981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324008942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324038982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324068069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324407101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324465036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324515104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324522018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324557066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324578047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324759960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324803114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324836016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324841976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.324876070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.324898005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.326374054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.326412916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.326469898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.326477051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.326534033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.326878071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.326919079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.326956034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.326962948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.326991081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.327013969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.375803947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.375848055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.376008034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.376008034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.376017094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.376060009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.376065969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.376086950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.376126051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.376133919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.376156092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.376163006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.376192093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.376224995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.414067030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.414108038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.414273977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.414273977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.414282084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.414330006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.414459944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.414499044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.414534092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.414541006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.414572001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.414592028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.415302038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.415342093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.415394068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.415400028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.415446043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.415597916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.415661097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.415679932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.415744066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.417434931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.417475939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.417516947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.417529106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.417558908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.417582989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.418510914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.418550968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.418591976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.418597937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.418632030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.418654919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.466397047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.466438055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.466631889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.466639042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.466696978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.466826916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.466866970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.466906071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.466912031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.466943979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.466965914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.505940914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506012917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506074905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506082058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506144047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506165028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506206989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506232977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506238937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506261110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506283998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506762028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506803036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506845951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506851912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.506886005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.506907940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.507128000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.507169008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.507209063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.507215977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.507252932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.507275105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.508760929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.508804083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.508842945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.508850098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.508878946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.508900881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.509756088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.509797096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.509836912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.509843111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.509871960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.509895086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.557215929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.557261944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.557327032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.557334900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.557389021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.557636023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.557679892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.557712078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.557718992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.557740927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.557765007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.596539974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.596582890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.596654892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.596664906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.596714020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.597058058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.597098112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.597135067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.597141027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.597167969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.597188950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.597484112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.597522974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.597559929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.597565889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.597600937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.597620010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.598095894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.598134995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.598177910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.598185062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.598217010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.598239899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.599550009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.599591017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.599633932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.599639893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.599669933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.599692106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.600908995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.600949049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.600985050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.600991011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.601027012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.601043940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.648248911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.648310900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.648408890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.648416996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.648466110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.648606062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.648662090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.648701906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.648709059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.648751974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.649064064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.687726974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.687793970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.687830925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.687838078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.687891006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.688235998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.688276052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.688319921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.688325882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.688355923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.688374043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.688777924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.688822031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.688863993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.688870907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.688905001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.688929081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.689230919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.689270973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.689310074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.689316988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.689352036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.689374924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.690294027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.690332890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.690372944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.690378904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.690414906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.690428019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.692895889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.692938089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.692976952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.692982912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.693011999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.693032026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.739939928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.739981890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.740068913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.740076065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.740127087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.740199089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.740238905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.740269899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.740276098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.740313053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.740334988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.778876066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.778918982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.778980970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.778990030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779026985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.779052019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.779458046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779515028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779544115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.779550076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779597044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.779756069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779795885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779829025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.779834986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.779860020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.779881001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.780591965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.780649900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.780680895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.780687094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.780746937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.780746937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.782037020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.782077074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.782105923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.782125950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.782146931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.782171965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.783549070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.783587933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.783624887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.783632040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.783663988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.783684969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.830914974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.830980062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.831012964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.831020117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.831064939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.831237078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.831278086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.831295013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.831315041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.831337929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.831365108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.869530916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.869616032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.869652987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.869719028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.870071888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.870114088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.870158911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.870166063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.870187998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.870210886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.873410940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.873452902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.873492002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.873498917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.873543978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.873560905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.873928070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.874008894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.874034882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.874042034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.874074936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.874097109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.874401093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.874443054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.874480009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.874485970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.874525070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.874536991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.874963999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.875004053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.875041008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.875046968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.875089884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.921983957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.922004938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.922117949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.922128916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.922175884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.922525883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.922548056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.922609091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.922616959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.922656059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.961077929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.961098909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.961173058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.961184025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.961227894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.961438894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.961460114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.961508036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.961522102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.961551905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.961594105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.964287996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.964308023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.964390039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.964396954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.964442015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.964782000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.964802027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.964869022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.964876890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.964919090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.965264082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.965285063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.965342045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.965348005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.965389013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.965747118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.965773106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.965847015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:48.965853930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:48.965904951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.012929916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.012955904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.013048887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.013057947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.013103962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.013819933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.013839006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.013895035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.013901949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.013936996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.013959885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.051703930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.051744938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.051814079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.051821947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.051881075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.052150011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.052191019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.052232981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.052239895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.052263975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.052287102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.056412935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.056452990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.056499004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.056505919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.056560040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.056950092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.056991100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.057029963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.057035923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.057060957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.057086945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.057354927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.057395935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.057435036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.057440996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.057475090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.057501078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.058578014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.058618069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.058656931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.058662891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.058701038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.103316069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.103362083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.103578091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.103578091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.103585958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.103635073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.104692936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.104732990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.104764938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.104772091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.104798079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.104808092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.142344952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.142394066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.142533064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.142533064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.142539978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.142581940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.142988920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.143029928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.143074036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.143079996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.143110037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.143120050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.147799969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.147847891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.147872925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.147880077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.147910118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.147927999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.148163080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.148204088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.148241997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.148247957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.148274899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.148288012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.151021957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.151072025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.151106119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.151112080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.151137114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.151149988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.151537895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.151581049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.151618958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.151626110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.151648998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.151664019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.194533110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.194581985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.194633961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.194643021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.194673061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.194686890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.195513964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.195555925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.195590973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.195596933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.195621967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.195633888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.233388901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.233431101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.233473063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.233479023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.233515978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.233524084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.234206915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.234249115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.234287024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.234292984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.234318972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.234334946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.238934994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.238976955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.239027977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.239034891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.239068985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.239077091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.239758015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.239798069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.239837885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.239844084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.239871025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.239886045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.241192102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.241236925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.241276026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.241281986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.241300106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.241323948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.242343903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.242384911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.242422104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.242428064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.242450953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.242472887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.285300970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.285341978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.285520077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.285520077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.285531998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.285576105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.286351919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.286395073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.286425114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.286432028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.286459923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.286479950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.324035883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.324078083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.324129105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.324136972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.324342012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.324342012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.325079918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.325123072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.325176001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.325184107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.325217009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.325234890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.329930067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.329972982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.330010891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.330018044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.330051899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.330063105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.330518007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.330571890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.330607891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.330615044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.330642939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.330657005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.332062960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.332108021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.332144976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.332151890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.332175970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.332194090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.333369017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.333410978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.333445072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.333451033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.333478928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.333492041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.376153946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.376199007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.376244068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.376256943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.376413107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.376413107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.377087116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.377129078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.377168894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.377176046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.377206087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.377214909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.414792061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.414834976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.414876938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.414884090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.414912939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.414927006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.415873051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.415913105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.415939093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.415946007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.415975094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.415988922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.420667887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.420707941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.420737982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.420744896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.420773983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.420789957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.430588961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.430645943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.430671930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.430679083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.430707932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.430726051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.430867910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.430908918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.430953979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.430960894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.430973053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.430999994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.431646109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.431685925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.431723118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.431730032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.431756973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.431775093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.467416048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.467458010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.467495918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.467503071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.467538118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.467664957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.468811989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.468868971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.468883038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.468890905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.468919992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.468930960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.505789995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.505831003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.505868912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.505875111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.505903959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.505923033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.506563902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.506607056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.506648064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.506654024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.506683111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.506699085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.511749983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.511805058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.511846066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.511852980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.511881113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.511894941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.521368980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.521411896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.521456003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.521462917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.521490097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.521500111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.521656036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.521699905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.521718025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.521725893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.521745920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.521758080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.522085905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.522125959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.522160053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.522165060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.522191048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.522202015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.558574915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.558618069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.558653116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.558660030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.558686018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.558705091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.559503078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.559545040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.559577942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.559583902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.559611082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.559628010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.597045898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.597089052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.597146988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.597157955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.597173929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.597197056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.597533941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.597574949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.597599030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.597604990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.597631931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.597646952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.602478027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.602520943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.602564096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.602572918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.602611065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.602623940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.612034082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.612073898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.612123013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.612131119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.612154961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.612174034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.612943888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.613001108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.613029003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.613034964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.613059044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.613073111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.613236904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.613280058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.613301992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.613311052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.613333941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.613341093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.649239063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.649280071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.649597883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.649605989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.649658918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.650299072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.650341988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.650382996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.650388956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.650414944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.650432110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.687488079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.687530994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.687680006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.687680006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.687689066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.687730074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.688569069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.688623905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.688657045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.688666105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.688683033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.688710928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.693320990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.693363905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.693418980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.693425894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.693455935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.693476915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703001976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.703043938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.703087091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703093052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.703253031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703253031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703433037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.703471899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.703496933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703502893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.703521013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703550100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.703962088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.704003096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.704035997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.704042912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.704066992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.704077959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.740185976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.740228891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.740277052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.740283966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.740320921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.740334988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.741189957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.741230011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.741262913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.741269112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.741293907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.741317034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.778498888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.778539896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.778672934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.778672934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.778680086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.778779984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.779443026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.779484034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.779515028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.779521942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.779546976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.779561043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.784079075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.784120083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.784154892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.784161091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.784185886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.784195900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.793843985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.793885946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.793927908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.793936968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.794133902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.794133902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.794259071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.794317007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.794331074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.794338942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.794357061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.794375896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.794925928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.794965982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.794997931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.795005083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.795017004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.795043945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.831466913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.831507921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.831643105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.831643105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.831650972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.831693888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.832169056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.832212925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.832247019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.832252979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.832283974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.832295895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.869098902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.869152069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.869438887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.869447947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.869496107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.870337009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.870393038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.870439053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.870445013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.870476961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.870490074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.874804020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.874859095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.874906063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.874912024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.874954939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.874975920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.884805918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.884848118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.884926081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.884933949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.884993076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.885374069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.885449886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.885485888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.885492086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.885518074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.885533094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.885781050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.885822058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.885852098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.885858059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.885890007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.885909081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.922651052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.922708035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.922759056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.922765017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.922806025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.922818899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.923142910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.923186064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.923227072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.923238039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.923270941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.923290014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.960371971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.960416079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.960500002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.960505962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.960654020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.962013006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.962054014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.962120056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.962126970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.962155104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.962188005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.965692043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.965733051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.965786934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.965795040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.965848923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.976587057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.976629019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.976675034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.976682901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.976722956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.976743937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977237940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977278948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977319956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977325916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977360964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977374077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977387905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977406025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977426052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977473021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977478981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977500916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:49.977535963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:49.977555037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.013588905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.013633013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.013685942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.013700008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.013752937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.013778925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.013910055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.013966084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.013997078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.014003038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.014039993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.014061928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.050955057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.051000118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.051037073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.051043987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.051081896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.051100016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.052680969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.052723885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.052759886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.052766085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.052783012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.052871943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.056679010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.056720018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.056761026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.056767941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.056801081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.056819916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.067718029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.067761898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.067800999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.067807913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.067868948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.068031073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.068042994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.068083048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.068104982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.068110943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.068155050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.068173885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.068599939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.068640947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.068674088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.068685055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.068727016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287118912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287142992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287185907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287242889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287259102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287307024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287339926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287386894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287416935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287424088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287447929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287472010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287823915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287868023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287900925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287909031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.287951946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.287974119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.288630009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.288702011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.288724899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.288731098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.288778067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289215088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289254904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289304018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289311886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289335966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289355040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289356947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289383888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289417982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289433002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289453030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289460897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.289491892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.289520979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290262938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290307045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290359020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290365934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290404081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290406942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290431023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290436983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290460110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290469885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290503025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290508986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.290538073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.290585995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.291217089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291255951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291304111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.291310072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291346073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291352987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.291371107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291408062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.291416883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291429996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.291440964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.291469097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.291503906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.292069912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292109013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292146921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.292155027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292198896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292201042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.292222977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292260885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.292267084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292282104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.292293072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.292325974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.292357922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.293023109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.293064117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.293107986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.293116093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.293152094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.293174982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294008017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294049025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294090033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294096947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294131994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294157028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294158936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294181108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294218063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294223070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294255018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294266939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294291019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294326067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294729948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294783115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294826031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294832945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294857979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294882059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294913054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294956923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.294981003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.294987917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.295018911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.295039892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.295500040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.295546055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.295589924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.295597076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.295640945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.323872089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.323914051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.324244976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.324254990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.324301004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.325254917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.325297117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.325340986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.325347900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.325385094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.325411081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.329514027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.329555988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.329598904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.329607010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.329651117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342001915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342046976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342101097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342109919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342164040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342681885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342725992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342783928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342791080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342813015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342819929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342842102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342849016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342871904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342884064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342931986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.342937946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.342981100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.377305031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.377347946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.377408981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.377418995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.377465963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.377947092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.377989054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.378027916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.378034115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.378063917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.378086090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.417186975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.417233944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.417303085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.417319059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.417382002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.418399096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.418437958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.418487072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.418493986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.418524027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.418550014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.431672096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.431727886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.431768894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.431777000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.431833982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.432679892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.432723045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.432760954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.432768106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.432801008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.432832003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.433069944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.433124065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.433151960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.433159113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.433193922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.433223009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.434103012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.434146881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.434175968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.434181929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.434217930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.434240103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.468305111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.468352079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.468417883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.468425989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.468475103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.468862057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.468904972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.468941927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.468947887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.468970060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.468997955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.507927895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.507968903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.508035898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.508043051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.508089066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.511430025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.511471033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.511519909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.511527061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.511560917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.511584997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.523763895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.523823023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.523875952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.523884058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.523935080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.525926113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.525969028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.526026011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.526032925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.526057959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.526077986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.526813984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.526870966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.526901007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.526907921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.526949883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.527038097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.527081013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.527101040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.527107954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.527141094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.527168036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.559688091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.559736013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.559806108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.559812069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.559870005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.559895039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.559937954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.559962988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.559968948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.560003996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.560017109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.598573923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.598620892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.598675013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.598685980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.598728895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.602406979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.602454901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.602497101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.602504969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.602534056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.602555037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.614476919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.614520073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.614631891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.614631891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.614643097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.614686012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.616581917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.616636992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.616704941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.616714001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.616748095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.616767883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.617060900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.617105007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.617142916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.617149115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.617178917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.617201090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.617650032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.617696047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.617722988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.617729902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.617772102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.617779970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.651979923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.652036905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.652079105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.652090073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.652139902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.652326107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.652396917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.652398109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.652426004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.652461052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.652484894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.689194918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.689239979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.689315081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.689322948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.689373016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.693654060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.693711996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.693753004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.693758965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.693814993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.705298901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.705344915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.705401897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.705410004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.705471039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.707262993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.707304955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.707345009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.707350969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.707393885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.707415104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.707967997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.708007097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.708046913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.708054066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.708087921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.708112955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.708364010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.708404064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.708441973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.708448887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.708477974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.708513021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.741019964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.741061926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.741101980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.741108894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.741142988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.741167068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.742480040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.742521048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.742554903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.742562056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.742592096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.742613077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.783298969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.783341885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.783385992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.783392906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.783431053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.783457994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.790342093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.790383101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.790429115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.790436029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.790471077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.790489912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.797651052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.797703981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.797744036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.797750950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.797787905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.797808886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.798140049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.798187017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.798221111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.798230886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.798261881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.798284054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.798664093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.798708916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.798744917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.798755884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.798788071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.798808098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.799151897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.799192905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.799230099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.799236059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.799271107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.799294949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.831718922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.831759930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.831824064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.831830978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.831882954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.833203077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.833244085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.833278894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.833286047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.833318949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.833337069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.874165058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.874211073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.874387980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.874396086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.874444008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.881069899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.881114006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.881154060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.881160975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.881206036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.888221979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.888262987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.888303041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.888309956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.888333082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.888351917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.888942003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.888983011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.889020920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.889027119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.889059067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.889081001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.889473915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.889528990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.889548063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.889554977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.889585972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.889605999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.890506029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.890546083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.890582085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.890588999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.890621901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.890641928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.922516108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.922558069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.922720909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.922729015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.922780991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.923923016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.923964977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.924015045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.924021959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.924069881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.965112925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.965154886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.965236902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.965245962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.965280056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.965298891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.971951008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.972004890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.972095966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.972105026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.972162962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.979988098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.980027914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.980089903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.980098009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.980156898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.980514050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.980554104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.980578899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.980585098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.980614901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.980635881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.981050968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.981091976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.981120110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.981127024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.981159925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.981183052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.981590986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.981632948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.981662035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.981668949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:50.981699944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:50.981719971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.013336897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.013377905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.013547897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.013556957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.013603926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.014715910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.014759064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.014803886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.014810085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.014848948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.014868021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.055962086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.056008101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.056070089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.056081057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.056129932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.062896013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.062937975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.062983990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.062990904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.063009024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.063036919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.070394993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.070434093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.070483923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.070491076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.070521116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.070540905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.070579052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.070621967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.070641041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.070647955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.070683956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.070700884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.071083069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.071122885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.071161032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.071167946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.071194887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.071214914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.071690083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.071731091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.071769953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.071777105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.071806908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.071825981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.104145050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.104190111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.104243040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.104250908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.104281902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.104302883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.105575085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.105617046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.105660915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.105668068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.105696917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.105720997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.146795034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.146850109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.146894932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.146903992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.146938086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.146959066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.153460026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.153501987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.153542995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.153549910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.153580904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.153603077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.165087938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.165129900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.165175915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.165183067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.165210962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.165230989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.166676044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.166717052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.166754007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.166760921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.166789055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.166811943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.167351007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.167392969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.167429924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.167437077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.167464972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.167484999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.167642117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.167684078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.167716026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.167721987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.167754889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.167774916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.196110010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.196150064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.196202993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.196209908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.196253061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.196652889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.196693897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.196736097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.196743011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.196765900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.196787119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.237515926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.237575054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.237631083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.237641096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.237673044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.237695932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.244313002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.244363070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.244431019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.244438887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.244502068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.255840063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.255882025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.255954981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.255961895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.255981922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.256016016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.257591963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.257652044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.257685900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.257693052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.257723093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.257744074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.257971048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.258013010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.258053064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.258059025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.258086920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.258111000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.258722067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.258768082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.258804083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.258810997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.258846045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.258867025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.287429094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.287472963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.287512064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.287518978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.287575006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.290627956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.290683031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.290723085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.290730000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.290756941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.290796041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.328346014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.328387976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.328433990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.328444958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.328479052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.328505993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.335036039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.335079908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.335129976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.335139036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.335175991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.335196972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.346610069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.346651077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.346688032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.346694946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.346724033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.346748114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.348107100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.348171949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.348198891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.348206043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.348242044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.348264933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.348731995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.348777056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.348808050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.348814964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.348850012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.348885059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.349472046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.349513054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.349556923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.349562883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.349596024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.349617004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.378177881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.378221989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.378268957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.378276110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.378340960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.381335974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.381376982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.381427050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.381433964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.381474018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.381494999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.435388088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.435436010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.435504913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.435522079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.435561895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.435583115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.435643911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.435687065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.435718060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.435724020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.435762882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.435784101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.440126896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.440166950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.440212965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.440220118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.440257072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.440279961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.440808058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.440850019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.440880060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.440886974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.440917015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.440943003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.441200972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.441241980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.441277981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.441284895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.441317081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.441334009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.445245028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.445286989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.445414066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.445414066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.445421934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.445466995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.468934059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.468990088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.469037056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.469046116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.469062090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.469326973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.472084045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.472125053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.472165108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.472172022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.472204924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.472223043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.526158094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.526204109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.526264906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.526273966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.526318073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.526339054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.526695967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.526737928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.526774883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.526781082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.526813030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.526834011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.530936956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.530980110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.531018972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.531024933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.531059027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.531080008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.531512022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.531554937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.531591892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.531599045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.531634092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.531651974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.531965971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.532007933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.532044888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.532051086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.532085896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.532102108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.536098957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.536160946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.536184072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.536195040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.536221981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.536246061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.561064005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.561108112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.561160088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.561166048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.561217070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.617012024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.617072105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.617125988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.617132902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.617162943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.617185116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.617325068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.617367983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.617400885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.617408037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.617441893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.617461920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.621442080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.621506929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.621522903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.621530056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.621561050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.621589899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.622072935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.622132063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.622154951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.622162104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.622193098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.622215033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.622628927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.622673035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.622706890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.622715950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.622749090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.622769117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.623014927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.623054981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.623094082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.623100042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.623131037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.623156071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.627433062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.627486944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.627531052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.627537966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.627587080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.652002096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.652046919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.652092934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.652100086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.652142048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.710171938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.710216999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.710284948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.710294962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.710347891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.710375071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.710417032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.710443020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.710449934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.710475922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.710498095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.712291956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.712331057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.712378025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.712384939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.712433100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.712986946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.713027000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.713068962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.713076115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.713099003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.713124990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.713560104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.713599920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.713640928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.713649035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.713680029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.713701963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.714216948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.714260101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.714301109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.714307070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.714344025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.714360952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.718367100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.718406916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.718451023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.718456984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.718492985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.718516111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.742645025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.742688894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.742743969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.742750883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.742799044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.800551891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.800595999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.800673008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.800684929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.800714970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.800739050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.801165104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.801208973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.801255941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.801263094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.801328897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.801328897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.803132057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.803174973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.803221941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.803227901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.803258896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.803282976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.803627968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.803668976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.803708076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.803714037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.803750992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.803829908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.804301977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.804343939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.804380894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.804388046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.804420948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.804445028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.804949999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.804997921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.805038929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.805046082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.805078030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.805102110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.808950901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.808993101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.809036016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.809042931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.809084892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.833349943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.833391905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.833450079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.833456039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.833499908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.833520889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.891479969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.891525984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.891582012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.891592026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.891628981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.891652107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.891860962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.891901970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.891952038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.891957998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.891983032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.892002106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.893924952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.893965960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.894151926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.894159079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.894212961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.894531012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.894571066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.894607067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.894613028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.894659996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.895184040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.895241976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.895275116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.895281076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.895330906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.895330906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.895690918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.895733118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.895768881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.895776033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.895816088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.895838976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.899818897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.899857998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.899899006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.899904966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.899947882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.899962902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.924335003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.924382925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.924436092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.924443960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.924488068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.982357025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.982399940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.982441902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.982453108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.982496023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.982523918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.982805967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.982845068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.982870102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.982877016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.982914925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.982933044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.984597921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.984654903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.984669924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.984677076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.984713078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.984731913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.985337973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.985377073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.985419035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.985424995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.985465050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.985486031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.986875057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.986927986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.986978054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.986984015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.987035036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.987487078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.987526894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.987561941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.987569094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.987591982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.987612009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.995620012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.995676994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.995723963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:51.995731115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:51.995783091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.014903069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.014941931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.014991999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.015001059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.015053034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.073159933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.073208094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.073286057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.073299885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.073347092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.073360920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.073508978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.073550940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.073587894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.073595047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.073626995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.073642015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.075515032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.075558901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.075598955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.075604916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.075638056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.075656891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.076132059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.076170921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.076217890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.076224089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.076272011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.077707052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.077747107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.077794075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.077800989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.077825069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.077851057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.078607082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.078644991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.078686953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.078692913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.078737020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.078743935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.086252928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.086297035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.086347103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.086354017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.086394072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.086417913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.112293005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.112334967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.112385035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.112391949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.112430096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.112453938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.164060116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.164103985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.164151907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.164159060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.164187908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.164227962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.164601088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.164660931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.164683104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.164690018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.164735079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.166076899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.166120052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.166161060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.166167021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.166192055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.166213989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.166743040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.166795969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.166834116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.166840076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.166877031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.166898966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.168418884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.168462992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.168507099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.168514967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.168556929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.169051886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.169095039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.169102907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.169121027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.169135094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.169168949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.169205904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.177249908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.177289963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.177345037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.177351952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.177400112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.202964067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.203003883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.203092098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.203098059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.203130960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.203154087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.254777908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.254822969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.254897118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.254905939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.254945040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.254970074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.255213022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.255254984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.255290031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.255296946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.255326986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.255352974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.256993055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.257033110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.257075071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.257081985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.257114887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.257131100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.257522106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.257563114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.257602930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.257608891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.257638931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.257662058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.259167910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.259210110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.259247065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.259253979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.259284973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.259305000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.260169029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.260210037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.260247946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.260253906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.260287046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.260305882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.267945051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.268016100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.268050909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.268057108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.268107891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.295192957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.295236111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.295440912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.295448065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.295489073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.351351023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.351394892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.351465940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.351474047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.351517916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.351790905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.351831913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.351871967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.351878881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.351907969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.351928949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.352411985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.352471113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.352518082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.352524996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.352560997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.352581978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.352945089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.353008986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.353037119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.353043079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.353081942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.353101969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.353550911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.353596926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.353642941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.353650093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.353682995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.353705883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.354340076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.354378939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.354435921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.354441881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.354475975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.354494095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.358669996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.358711958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.358758926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.358766079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.358800888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.358817101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.386113882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.386158943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.386327028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.386337042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.386387110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.441948891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.441994905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442101002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.442107916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442161083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.442558050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442600012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442634106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.442640066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442688942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.442812920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442857027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442899942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.442907095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.442934036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.442956924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.443875074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.443916082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.443954945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.443962097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.443989992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444013119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444540977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.444580078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.444617987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444624901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.444658041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444679022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444716930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.444755077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.444786072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444792986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.444824934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.444844007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.449553967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.449598074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.449631929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.449641943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.449673891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.449692965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.478344917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.478387117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.478420973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.478426933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.478463888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.478483915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.532970905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.533013105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.533086061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.533102989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.533140898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.533194065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.533541918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.533593893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.533643961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.533651114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.533688068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.533710003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.534054995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.534096956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.534143925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.534151077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.534188032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.534213066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.534879923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.534940958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.534980059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.534986019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535020113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535043001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535531044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535571098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535613060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535619020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535650015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535670042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535670996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535698891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535732985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535744905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535769939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535778046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.535806894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.535839081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.540086031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.540126085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.540169954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.540177107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.540205956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.540227890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.569547892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.569591045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.569648981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.569655895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.569691896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.569714069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.629486084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.629527092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.629581928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.629597902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.629636049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.629658937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.630047083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.630088091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.630140066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.630146980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.630192995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.630848885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.630888939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.630928993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.630934954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.630995035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.631123066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.631165028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.631194115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.631200075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.631227016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.631248951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632143021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632184982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632229090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632235050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632266045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632280111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632287979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632306099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632342100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632352114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632378101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632385015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.632426977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632477999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.632997036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.633037090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.633075953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.633083105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.633114100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.633136988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.660350084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.660396099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.660458088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.660491943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.660510063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.660541058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.721338987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.721395969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.721436024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.721446037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.721493959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.721919060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.721960068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.721992016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.721998930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.722026110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.722052097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.722611904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.722651958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.722702980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.722711086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.722721100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.722750902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.723140955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.723181963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.723213911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.723221064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.723251104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.723275900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.723617077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.723655939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.723684072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.723691940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.723723888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.723741055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724551916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724591017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724626064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724633932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724668026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724688053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724689960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724713087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724749088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724759102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724786043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724795103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.724821091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.724850893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.755203009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.755248070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.755311012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.755323887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.755378962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.812114954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.812160969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.812227011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.812241077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.812306881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.812657118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.812697887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.812736034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.812743902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.812772989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.812803030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.813106060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.813146114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.813193083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.813199997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.813226938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.813319921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.814083099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.814122915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.814182043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.814188957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.814222097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.814235926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.814261913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.814270973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.814299107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.814300060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.814352989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.814388037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.815290928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.815330982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.815391064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.815398932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.815424919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.815445900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.815486908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.815541983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.815557957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.815566063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.815604925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.815623045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.845897913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.845952034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.845988035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.845999002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.846045017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.905858994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.905936003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.905968904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906006098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906019926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906054020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906339884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906379938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906424046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906431913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906466961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906488895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906814098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906857014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906900883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906908035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.906936884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.906960964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.907640934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.907680988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.907718897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.907725096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.907756090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.907773018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.908291101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.908329964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.908369064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.908375978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.908406019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.908420086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.909096003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.909151077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.909163952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.909172058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.909197092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.909223080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.909287930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.909327030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.909356117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.909363031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.909374952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.909406900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.938000917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.938040972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.938102007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.938108921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.938164949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.996263027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.996313095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.996373892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.996381044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.996424913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.996444941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.996867895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.996912956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.996939898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.996947050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.996985912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.997004986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.997554064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.997597933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.997623920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.997631073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.997665882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.997688055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998023033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998080015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998095036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998106003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998133898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998158932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998673916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998713970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998748064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998754978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998806000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998811007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998858929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998863935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998874903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998883963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.998922110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.998951912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.999821901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.999874115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.999912024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.999917984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:52.999931097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:52.999958038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.031451941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.031493902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.031570911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.031579018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.031631947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.088589907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.088635921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.088697910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.088715076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.088756084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.088778019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.088932991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.088974953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.088999987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.089010954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.089050055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.089056969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090004921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090044975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090082884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090089083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090117931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090140104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090579987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090620995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090651035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090656996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090686083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090707064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090717077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090758085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090784073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090790987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.090825081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.090847969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.092015982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.092055082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.092087984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.092093945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.092123985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.092147112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.092303038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.092355967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.092384100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.092390060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.092421055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.092442036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.122034073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.122078896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.122169018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.122178078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.122229099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.183140039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.183201075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.183253050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.183259964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.183303118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.183325052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.183857918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.183902025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.183943987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.183953047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.183989048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.184004068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.184303999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.184360027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.184379101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.184386015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.184420109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.184442997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.185276031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.185317039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.185368061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.185374975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.185405970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.185429096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.185890913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.185935020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.185973883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.185980082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.186014891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.186033964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.186517000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.186589956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.186609983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.186616898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.186657906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.186671972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.187325954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.187367916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.187410116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.187416077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.187448025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.187468052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.212795973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.212852001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.212877989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.212886095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.212933064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.212961912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.279879093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.279922962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.279973984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.279983997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280023098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.280042887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.280324936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280364990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280399084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.280405045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280442953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.280453920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.280808926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280849934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280884981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.280891895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.280936003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.281418085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.281461954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.281517982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.281524897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.281536102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.281568050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.281949997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.281991959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.282032013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.282037973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.282075882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.282109022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.282671928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.282711029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.282748938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.282756090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.282777071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.282812119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.283427954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.283468962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.283514977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.283523083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.283560991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.283579111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.303631067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.303673029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.303715944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.303723097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.303755999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.303778887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.378197908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.378254890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.378289938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.378300905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.378351927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.379137039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.379179001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.379228115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.379235029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.379266024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.379287958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.379762888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.379827023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.379868031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.379874945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.379918098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.380676985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.380717039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.380781889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.380789042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.380817890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.380825043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.381614923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.381668091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.381707907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.381715059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.381752014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.381773949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.382539034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.382581949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.382616997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.382623911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.382671118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.382863998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.382919073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.382945061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.382951975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.382977962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.382997036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.394534111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.394576073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.394639969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.394645929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.394810915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.469379902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.469405890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.469515085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.469523907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.469578028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.469835997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.469851017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.469917059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.469923973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.469968081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.470448017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.470463991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.470525980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.470534086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.470576048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.471121073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.471136093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.471200943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.471209049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.471254110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.472254038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.472268105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.472332001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.472338915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.472378016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.472893953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.472935915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.472971916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.472978115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.473011017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.473035097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.473581076 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.473623991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.473658085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.473664999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.473702908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.473725080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.485155106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.485199928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.485235929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.485248089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.485275030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.485299110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.560278893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.560323954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.560374975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.560386896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.560425043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.560442924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.561000109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.561043024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.561081886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.561089039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.561125040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.561145067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.561569929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.561630011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.561654091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.561660051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.561688900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.561712980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.562182903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.562238932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.562273026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.562279940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.562311888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.562330961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.563146114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.563191891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.563230991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.563236952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.563266993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.563285112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.563689947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.563735962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.563769102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.563776016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.563807011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.563831091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.564302921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.564343929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.564383030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.564388990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.564424038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.564444065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.575939894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.575982094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.576036930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.576042891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.576078892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.576098919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.651149035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.651195049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.651252031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.651261091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.651307106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.651325941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.651901960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.651943922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.651984930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.651990891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.652034998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.652461052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.652525902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.652543068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.652550936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.652584076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.652607918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.653131962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.653175116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.653217077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.653223038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.653254986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.653271914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.653692007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.653734922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.653769016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.653775930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.653805017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.653830051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.654390097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.654436111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.654474020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.654480934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.654517889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.654539108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.654938936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.654980898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.655025005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.655030966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.655073881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.666749001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.666794062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.666837931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.666845083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.666893959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.741897106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.741946936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.741997957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.742013931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.742054939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.742078066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.742758036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.742800951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.742844105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.742851973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.742897034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.743379116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.743467093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.743509054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.743578911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.743968010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.744010925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.744048119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.744054079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.744079113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.744103909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.744679928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.744724035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.744766951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.744772911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.744808912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.744831085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.745260954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.745302916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.745338917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.745345116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.745387077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.745780945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.745822906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.745858908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.745866060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.745882034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.745912075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.760471106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.760533094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.760560036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.760565996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.760602951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.760623932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.832701921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.832751036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.832807064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.832815886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.832878113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.833606005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.833652020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.833686113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.833692074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.833734989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.834239960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.834286928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.834312916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.834320068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.834351063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.834368944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.834866047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.834909916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.834943056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.834949970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.834995985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.835895061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.835939884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.835977077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.835983992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836023092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.836452007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836510897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836529016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.836536884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836571932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.836596966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.836831093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836873055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836905003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.836910963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.836950064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.851412058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.851433039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.851481915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.851490974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.851531029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.851552010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.925633907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.925653934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.925714970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.925724983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.925770998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.925793886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.926024914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.926044941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.926111937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.926120043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.926168919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.926634073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.926647902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.926690102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.926697016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.926753044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.926753044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.927290916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.927304983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.927357912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.927366018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.927412033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.928005934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928020000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928067923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.928075075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928119898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.928705931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928720951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928769112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.928776026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928795099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928812027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928816080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.928828001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.928854942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.928894997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.942589998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.942636967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.942672014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.942678928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:53.942714930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:53.942734003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.016993999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.017043114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.017066002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.017074108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.017128944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.017534971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.017581940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.017606974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.017612934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.017642021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.017664909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.018141985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.018183947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.018207073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.018213987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.018250942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.018270016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.019718885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.019763947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.019800901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.019807100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.019850969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.022363901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.022407055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.022460938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.022468090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.022497892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.022521019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.023109913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.023154974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.023179054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.023185968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.023230076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.023634911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.023680925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.023710012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.023715973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.023741007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.023757935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.033519983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.033564091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.033586979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.033593893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.033622026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.033639908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.107685089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.107744932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.107839108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.107852936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.107891083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.107891083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.108341932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.108386993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.108424902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.108432055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.108459949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.108479023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.108812094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.108874083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.108887911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.108895063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.108927011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.108942032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.110862017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.110905886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.110928059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.110934973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.110961914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.110974073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113054991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.113116980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.113132954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113141060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.113164902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113179922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113524914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.113568068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.113600016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113605976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.113629103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113646984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.113996029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.114037991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.114073038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.114078999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.114111900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.114120007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.124201059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.124243021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.124283075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.124289036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.124317884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.124337912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.198715925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.198764086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.198848009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.198848009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.198856115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.198896885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.199198008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.199259996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.199265003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.199291945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.199326038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.199337006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.199939966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.199982882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.200010061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.200016022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.200043917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.200052023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.201576948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.201621056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.201647997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.201654911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.201678038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.201693058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.204144955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.204186916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.204217911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.204224110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.204248905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.204257011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.204617977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.204659939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.204675913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.204684019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.204705000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.204719067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.205140114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.205183983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.205207109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.205213070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.205244064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.205252886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.215075016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.215131044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.215161085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.215167999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.215193033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.215207100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.289408922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.289458036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.289516926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.289525032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.289541006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.289565086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.289880991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.289922953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.289957047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.289963007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.289978981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.289994001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.290587902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.290632010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.290653944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.290659904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.290678024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.290694952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.292350054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.292393923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.292423010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.292431116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.292439938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.292453051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.292474031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.294827938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.294871092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.294897079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.294903040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.294929028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.294941902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.295237064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.295279980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.295306921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.295314074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.295329094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.295344114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.295819998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.295866966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.295891047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.295897007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.295914888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.295937061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.306191921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.306236982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.306287050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.306296110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.306323051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.306344032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.380160093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.380191088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.380269051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.380278111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.380325079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.381084919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.381110907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.381174088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.381180048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.381208897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.381598949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.381629944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.381638050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.381650925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.381695986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.381728888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.384542942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.384571075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.384629011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.384637117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.384646893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.384679079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.385683060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.385710001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.385761023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.385768890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.385802984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.385812044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.386034012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.386059046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.386101007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.386107922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.386136055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.386149883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.386578083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.386611938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.386657953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.386665106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.386687994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.386710882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.396744967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.396773100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.396830082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.396836996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.396879911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.470977068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.471009016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.471045017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.471054077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.471071005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.471092939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.473371029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.473398924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.473449945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.473457098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.473483086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.473495960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.473865032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.473890066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.473929882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.473937988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.473953962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.473974943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.475651979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.475677013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.475720882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.475728989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.475744963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.475766897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.476653099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.476680994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.476718903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.476725101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.476816893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.477135897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.477164030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.477202892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.477210999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.477222919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.477245092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.477565050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.477593899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.477629900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.477638006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.477649927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.477669954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.487668037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.487694025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.487730026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.487735987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.487755060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.487777948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.561918974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.561949968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.562017918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.562027931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.562074900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.564538002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.564564943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.564623117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.564630985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.564661026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.564675093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.565016985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.565043926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.565087080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.565093994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.565113068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.565124989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.568522930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.568547010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.568627119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.568635941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.568675041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.569502115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.569528103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.569578886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.569586039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.569629908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.570383072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.570413113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.570451975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.570457935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.570481062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.570494890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.571122885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.571151018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.571191072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.571197033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.571213961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.571235895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.578672886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.578700066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.578743935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.578751087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.578772068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.578784943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.652622938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.652650118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.652693033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.652699947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.652729988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.652748108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.655448914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.655477047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.655519962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.655525923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.655556917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.655569077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.655750036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.655781984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.655812979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.655818939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.655843973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.655857086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.659260035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.659286022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.659318924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.659368038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.659373045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.659411907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.660315990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.660341024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.660379887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.660387039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.660418987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.660433054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.661128998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.661164999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.661199093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.661206961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.661235094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.661250114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.662379026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.662405014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.662465096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.662471056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.662502050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.662514925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.669604063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.669631004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.669673920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.669681072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.669719934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.669735909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.743570089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.743599892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.743640900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.743649960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.743685007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.743695021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.746467113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.746493101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.746530056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.746536970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.746562004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.746575117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.746943951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.746969938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.747005939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.747013092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.747040033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.747050047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.749991894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.750015974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.750051975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.750062943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.750087976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.750099897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.751007080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.751043081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.751085997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.751091957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.751121044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.751130104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.751878023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.751915932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.751935005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.751940966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.751967907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.751974106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.753410101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.753436089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.753472090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.753479958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.753513098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.753529072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.760312080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.760338068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.760390997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.760399103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.760435104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.760453939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.834469080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.834502935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.834537983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.834546089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.834574938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.834594965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.837135077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.837161064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.837199926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.837205887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.837239027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.837251902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.837658882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.837685108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.837727070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.837733030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.837763071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.837781906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.841110945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.841137886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.841180086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.841187000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.841217041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.841229916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.841734886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.841761112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.841794014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.841799974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.841840982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.842680931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.842704058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.842741013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.842746973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.842786074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.842798948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.845545053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.845571995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.845621109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.845628023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.845676899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.851152897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.851181030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.851217985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.851226091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.851259947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.851275921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.925199032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.925234079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.925270081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.925282001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.925313950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.925329924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.927963972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.927990913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.928035021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.928040981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.928075075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.928088903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.928347111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.928370953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.928411961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.928419113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.928457022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.928699017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.932905912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.932931900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.932981968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.932988882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.933021069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.933111906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.933269978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.933294058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.933334112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.933341980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.933352947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.933378935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.933936119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.933965921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.934003115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.934010029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.934039116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.934048891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.936109066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.936131954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.936173916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.936181068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.936213017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.936228991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.942003965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.942038059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.942070007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.942075968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:54.942114115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:54.942126989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.015840054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.015872002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.015907049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.015917063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.015944004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.015955925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.018686056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.018713951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.018757105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.018764019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.018790960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.018805027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.019203901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.019227982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.019267082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.019273043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.019285917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.019308090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.022727966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.022752047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.022789955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.022797108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.022826910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.022840977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.023171902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.023199081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.023237944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.023243904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.023272991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.023294926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.024106979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.024147034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.024163008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.024168968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.024193048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.024210930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.026923895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.026949883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.026981115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.026988029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.027019978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.027038097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.033571005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.033596992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.033639908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.033647060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.033710003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.033710003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.107386112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.107417107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.107462883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.107472897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.107495070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.107511044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.110364914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.110392094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.110431910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.110439062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.110471010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.110493898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.111304998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.111336946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.111382961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.111390114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.111424923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.111430883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.114496946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.114574909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.114622116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.114628077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.114655972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.114670038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.114844084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.114869118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.114908934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.114916086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.114942074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.114950895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.115380049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.115406036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.115441084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.115447044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.115457058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.115492105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.118379116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.118405104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.118448973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.118463039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.118475914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.118508101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.123456001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.123482943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.123532057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.123543978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.123573065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.123581886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.202689886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.202725887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.202776909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.202785015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.202816963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.202831984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.203315020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.203341007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.203376055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.203382969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.203414917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.203423023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.204072952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.204098940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.204139948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.204147100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.204175949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.204184055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.205391884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.205420971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.205480099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.205487013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.205517054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.205533028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.205938101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.205962896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.206003904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.206011057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.206038952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.206046104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.206583023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.206610918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.206660986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.206666946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.206697941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.206710100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.208789110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.208813906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.208846092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.208852053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.208884001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.208897114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.214232922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.214258909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.214294910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.214301109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.214334011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.214340925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.464355946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464387894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464448929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464493036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.464533091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.464543104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464586020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.464602947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464628935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464668989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.464675903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.464687109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.464720011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.465187073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.465210915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.465248108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.465255022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.465272903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.465289116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466240883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.466269970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.466301918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466309071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.466327906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466347933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466869116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.466892958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.466928959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466933966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.466964006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466972113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.466993093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.467019081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.467046022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.467052937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.467078924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.467087984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.467892885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.467919111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.467952967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.467958927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.467968941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.467992067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.468023062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.468044996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.468050957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.468076944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.468096018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.468863010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.468890905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.468923092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.468930006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.468940973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.469764948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.469786882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.469794989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.469814062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.469814062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.469841003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.469854116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.470578909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.470604897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.470643044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.470650911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.470662117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.470690012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.471321106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.471345901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.471409082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.471432924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.471432924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.471441031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.471457958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.471478939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.471499920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.471982002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472007036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472049952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472055912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472069025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472085953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472094059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472101927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472124100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472129107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472162962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472182989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472868919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472896099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472946882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472954035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.472978115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.472989082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.475162983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.475187063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.475239992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.475246906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.475277901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.475295067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.475852013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.476983070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.477010012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.477056980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.477063894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.477096081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.477107048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.477210999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.477236032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.477274895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.477283001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.477296114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.477324009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.479468107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.479491949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.479535103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.479541063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.479568005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.479584932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.480124950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.480154991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.480187893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.480195045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.480220079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.480228901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.482945919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.482971907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.483009100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.483016014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.483036041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.483055115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.486428976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.486453056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.486505985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.486512899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.486542940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.486550093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.487338066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.487364054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.487406015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.487411976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.487437963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.487448931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.565912008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.565938950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.565979958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.565990925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.566020012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.566026926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.567779064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.567802906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.567848921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.567853928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.567882061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.567894936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.568372011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.568397999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.568429947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.568437099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.568464041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.568489075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.570143938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.570168972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.570210934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.570218086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.570249081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.570266962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.570817947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.570844889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.570902109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.570909023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.570940018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.570954084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.573801041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.573836088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.573888063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.573894978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.573926926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.573940992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.577104092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.577130079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.577198029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.577204943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.577240944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.577249050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.577864885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.577889919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.577933073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.577940941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.577967882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.577986002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.656923056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.656949043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.656991959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.657006025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.657021046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.657046080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.658936024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.658960104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.659004927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.659012079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.659049034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.659055948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.659246922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.659281015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.659308910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.659315109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.659337997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.659351110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.661570072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.661596060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.661649942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.661658049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.661685944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.661705017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.661911964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.661936998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.661972046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.661979914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.661998034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.662019014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.664876938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.664901972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.664943933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.664951086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.664989948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.665000916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.668039083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.668062925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.668103933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.668109894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.668143034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.668155909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.668648005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.668672085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.668719053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.668725967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.668754101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.668776035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.751394033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.751425982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.751466990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.751478910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.751547098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.754925013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.754950047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.755004883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.755012035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.755045891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.755064011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.755315065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.755341053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.755377054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.755383015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.755409956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.755430937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.755976915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.756000042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.756031036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.756037951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.756057978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.756083012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.756522894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.756550074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.756587982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.756596088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.756617069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.756638050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.757040977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.757066011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.757103920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.757111073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.757143021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.757157087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.762243032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.762268066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.762320042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.762326956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.762360096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.762372017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.763603926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.763628960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.763678074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.763689995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.763706923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.763732910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.845155954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.845186949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.845241070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.845257044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.845283985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.845298052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.845788956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.845814943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.845875025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.845882893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.845916986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.845937967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.846198082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.846225023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.846257925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.846265078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.846291065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.846311092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.846919060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.846944094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.846992970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.846999884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.847024918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.847039938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.847443104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.847466946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.847524881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.847532034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.847786903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.851202011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.851227999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.851278067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.851284027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.851316929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.851334095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.853671074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.853698969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.853739023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.853745937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.853780985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.853796005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.859508991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.859535933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.859589100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.859596968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.859631062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.859642029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.935957909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.935986042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.936053038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.936064959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.936093092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.936108112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.936472893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.936512947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.936572075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.936578035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.936606884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.936620951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937155962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937184095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937231064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937237978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937268019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937275887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937783003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937809944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937877893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937882900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937897921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937923908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937927008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937937975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937946081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.937979937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.937988997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.942316055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.942342043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.942388058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.942394018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.942430019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.942447901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.944566965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.944591999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.944658041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.944665909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.944701910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.944720984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.950402975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.950428963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.950476885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:55.950484991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:55.950529099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027017117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027045965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027086973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027093887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027123928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027141094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027554989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027576923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027611017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027616024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027638912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027647018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027926922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027946949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.027981043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.027987957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.028053999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.028083086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.028671026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.028692961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.028759956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.028767109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.029057026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.029328108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.029347897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.029388905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.029396057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.029407024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.029455900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.033118963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.033138990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.033180952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.033188105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.033201933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.033243895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.035377026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.035398006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.035439968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.035446882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.035455942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.035485983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.041240931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.041270971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.041321039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.041328907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.041338921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.041369915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.123032093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.123087883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.123141050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.123155117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.123171091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.123195887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.123821020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.123862982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.123924017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.123931885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.123959064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.123980045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.124278069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.124320984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.124366999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.124373913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.124406099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.124413013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.124928951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.124969959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125029087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125036955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125053883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125085115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125710011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125765085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125794888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125802040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125834942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125847101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125919104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125962973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.125981092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.125988007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.126013994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.126025915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.126574993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.126616001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.126698971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.126707077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.126734018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.126749039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.132158041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.132198095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.132242918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.132250071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.132292032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.213838100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.213887930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.213953018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.213963032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.213973045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214004993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214410067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.214452982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.214488983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214495897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.214535952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214607000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214754105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.214797020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.214822054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214828014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.214888096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.214888096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.215398073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.215439081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.215466976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.215473890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.215497971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.215509892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.215764046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.215811968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.215851068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.215857983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.215879917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.215898037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.216461897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.216522932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.216541052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.216547966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.216563940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.216602087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.217564106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.217605114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.217629910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.217636108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.217664957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.217678070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.223006010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.223059893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.223104954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.223112106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.223145008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.223164082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.304883957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.304945946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.304971933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.304980993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305011034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.305025101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.305250883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305299997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305325031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.305330992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305361986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.305370092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.305741072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305789948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305805922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.305814028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.305850983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306119919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.306170940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.306220055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306226969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.306246042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306267023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306514025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.306555986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.306591988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306598902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.306636095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306709051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.306973934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.307023048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.307039976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.307046890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.307146072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.308569908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.308613062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.308634996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.308670044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.308676004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.308712006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.314013004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.314066887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.314081907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.314109087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.314115047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.314125061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.314194918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.395648003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.395709038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.395733118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.395747900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.395778894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.395787001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.396083117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.396136999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.396167040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.396173954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.396202087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.396212101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.396455050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.396526098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.396558046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.396564960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.396574020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.396604061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.397243977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.397289038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.397320986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.397327900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.397353888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.397361994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.397810936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.397865057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.397891045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.397897959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.397933960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.397953033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.398346901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.398394108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.398417950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.398425102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.398451090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.398467064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.400326967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.400377989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.400410891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.400418043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.400443077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.400559902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.404582977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.404635906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.404666901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.404674053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.404711008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.404721975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.486630917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.486695051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.486743927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.486768961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.486789942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.486805916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.486963034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.487018108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.487039089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.487046003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.487081051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.487081051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.487662077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.487706900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.487739086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.487745047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.487773895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.487788916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.488096952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.488140106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.488174915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.488181114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.488204956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.488224030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.488780975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.488826990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.488851070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.488857031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.488897085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.488913059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.489168882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.489212990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.489242077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.489248991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.489272118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.489284992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.491252899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.491296053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.491313934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.491322041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.491358042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.491406918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.495165110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.495218992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.495251894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.495258093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.495296001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.495307922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.577385902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.577482939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.577493906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.577507019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.577666998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.577711105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.577754021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.577773094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.577785015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.577799082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.577821970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.577830076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.578274012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.578335047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.578375101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.578382015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.578411102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.578429937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579413891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579457998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579484940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579492092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579518080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579535961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579762936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579812050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579862118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579871893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579904079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579911947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579916954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579943895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.579971075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.579998970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.580020905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.580087900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.582465887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.582508087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.582532883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.582542896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.582567930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.582586050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.587120056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.587162971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.587198019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.587205887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.587234020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.587251902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.670569897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.670615911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.670638084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.670650959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.670684099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.670702934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.671077013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.671118021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.671139002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.671145916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.671171904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.671188116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.671767950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.671813011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.671837091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.671844006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.671865940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.671880960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.672725916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.672771931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.672801018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.672807932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.672837973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.672853947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.672921896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.672986031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.673003912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673063040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.673327923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673372030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673389912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.673398018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673427105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.673441887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.673893929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673935890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673964977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.673971891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.673996925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.674010038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.677433968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.677474976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.677508116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.677515030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.677534103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.677560091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.761226892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.761276007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.761301994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.761312008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.761341095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.761359930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.761887074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.761929989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.761954069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.761960030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.761985064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762002945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762667894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.762710094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.762731075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762737036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.762758970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762772083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762891054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.762934923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.762950897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762959003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.762974977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.762990952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763008118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763499022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.763541937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.763559103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763566017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.763581038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763603926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763617992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763840914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.763900042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.763902903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763926029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.763957977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.763966084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.764580965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.764622927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.764636993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.764645100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.764662027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.764681101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.768398046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.768436909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.768462896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.768470049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.768501043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.768513918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.852015018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.852061033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.852108955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.852122068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.852154970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.852164030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.852422953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.852469921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.852505922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.852528095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.852534056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.852617979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.853156090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.853198051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.853244066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.853250980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.853283882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.853293896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.853522062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.853563070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.853596926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.853605032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.853631973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.853643894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.854195118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.854235888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.854281902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.854289055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.854316950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.854326963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.854576111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.854614973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.854640007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.854646921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.854674101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.854687929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.855315924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.855356932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.855393887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.855401039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.855432034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.855454922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.859647036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.859688997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.859728098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.859735012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.859766006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.859791994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.942847013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.942893982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.942924976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.942936897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.942966938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.942975998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.943617105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.943659067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.943689108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.943696022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.943725109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.943747044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.944192886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.944236040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.944264889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.944272041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.944299936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.944317102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.944469929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.944535017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.944555044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.944561958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.944586039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.944600105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.945399046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.945444107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.945533991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.945537090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.945560932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.945595980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.945609093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.945622921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.945635080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.945666075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.945688963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.946368933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.946408033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.946448088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.946455002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.946480036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.946499109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.950493097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.950531960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.950568914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.950576067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:56.950603008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:56.950623035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.034462929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.034526110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.034548998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.034558058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.034589052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.034606934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.034835100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.034885883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.034909964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.034917116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.034941912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.034962893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.035453081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.035495043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.035535097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.035542011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.035567999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.035583019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.036679983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.036722898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.036767960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.036775112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.036797047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.036812067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.036886930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.036935091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.036973000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.036979914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037003040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037019014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037139893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037188053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037220955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037228107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037250996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037265062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037343025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037384033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037408113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037414074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.037442923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.037451982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.041429996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.041480064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.041522980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.041529894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.041558981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.041578054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.129378080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.129422903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.129467964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.129477024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.129513979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.129528046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.129733086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.129755974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.129790068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.129796028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.129828930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.129842997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.130359888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.130393982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.130441904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.130450010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.130486012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.130498886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.130969048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.130990982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131050110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.131057978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131088018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.131097078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.131865025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131886005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131938934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131943941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.131953955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131973982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.131978035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.131999016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.132005930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.132019043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.132036924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.132050037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.132666111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.132687092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.132750988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.132759094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.132786036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.132819891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.133116961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.133136034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.133177042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.133184910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.133202076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.133227110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.220060110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.220082045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.220129013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.220144033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.220168114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.220194101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.220633984 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.220653057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.220705032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.220711946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.220740080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.220752954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.221133947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.221153021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.221189976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.221198082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.221223116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.221247911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.221714973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.221735954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.221777916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.221785069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.221810102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.221828938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.222435951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.222459078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.222502947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.222510099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.222539902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.222553968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.222935915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.222956896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.222995996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.223002911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.223035097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.223043919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.223495960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.223516941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.223570108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.223578930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.223623991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.223972082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.223990917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.224039078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.224045992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.224077940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.224092007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.314120054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.314167976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.314194918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.314203978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.314265013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.314763069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.314810038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.314842939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.314848900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.314873934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.314888000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.315275908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.315315962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.315351963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.315359116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.315372944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.315397978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.315912962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.315952063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.315993071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.315999031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.316024065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.316037893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.316360950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.316401958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.316431046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.316437006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.316463947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.316477060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.318674088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.318713903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.318746090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.318753958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.318778992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.318794012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.319015980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.319058895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.319077969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.319086075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.319101095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.319120884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.319777966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.319822073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.319844961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.319850922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.319876909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.319892883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.405086994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.405132055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.405158997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.405168056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.405194998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.405205011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.405587912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.405627012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.405657053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.405663013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.405695915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.405705929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.406116962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.406155109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.406189919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.406196117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.406218052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.406462908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.406475067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.406517982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.406541109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.406548023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.406558037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.406584024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.407298088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.407337904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.407371044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.407377005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.407401085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.407414913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.407725096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.407766104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.407807112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.407813072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.407840967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.407860994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.409825087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.409867048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.409898043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.409904003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.409929991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.409939051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.410211086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.410249949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.410278082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.410286903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.410327911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.410337925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.496304035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.496376038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.496421099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.496438980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.496464968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.496490955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.496752024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.496804953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.496826887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.496834040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.496865988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.496876001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.497296095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.497337103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.497368097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.497374058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.497406960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.497422934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.497663975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.497711897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.497744083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.497750998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.497771025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.497786999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.498388052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.498440981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.498475075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.498481035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.498505116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.498514891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.499001980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.499046087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.499077082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.499083042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.499108076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.499116898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.500679016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.500720024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.500752926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.500758886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.500780106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.500787020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.501115084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.501161098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.501183987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.501189947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.501216888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.501226902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.586893082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.586961031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.586986065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.586999893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.587025881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.587049961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.587513924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.587563992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.587593079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.587599039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.587627888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.587639093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.587939978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.587996006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.588026047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.588032007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.588057041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.588068962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.588325024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.588368893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.588392973 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.588398933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.588427067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.588434935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.589092016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.589144945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.589174986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.589181900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.589209080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.589216948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.589749098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.589791059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.589828968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.589835882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.589865923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.589886904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.591447115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.591492891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.591515064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.591527939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.591563940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.591574907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.591856956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.591901064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.591922045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.591928959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.591957092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.591973066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.677814960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.677855968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.677915096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.677953005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.677970886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.678177118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.678225040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.678231001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.678256989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.678289890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.678317070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.678930998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.678971052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679141045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.679152012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679569960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679614067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679641008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.679650068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679677010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.679698944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.679831982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679872990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679891109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.679899931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.679929018 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.679939985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.680520058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.680562019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.680592060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.680599928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.680623055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.680640936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.682179928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.682221889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.682249069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.682255983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.682281971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.682710886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.682758093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.682775974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.682785988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.682818890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.682840109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.768527985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.768585920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.768624067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.768641949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.768666983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.768979073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769030094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769046068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769069910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769098043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769117117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769360065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769407988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769428968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769437075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769454956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769746065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769799948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769809961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769829035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.769861937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.769876003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.770664930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.770705938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.770735979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.770744085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.770761013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.771131992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.771178961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.771198988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.771208048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.771239042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.771265030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773025036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.773071051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.773087978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773097992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.773130894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773139000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773595095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.773649931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.773668051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773677111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.773690939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773708105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.773720026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860074997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860132933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860167980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860184908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860214949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860229015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860394001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860436916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860464096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860471964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860502005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860511065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860878944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860919952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860955954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.860964060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.860992908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.861005068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.861346006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.861390114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.861418009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.861424923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.861450911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.861459970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862067938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.862113953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.862132072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862139940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.862155914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862175941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862184048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862519026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.862560034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.862575054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862585068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.862612963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.862623930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.864114046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.864157915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.864188910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.864196062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.864216089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.864465952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.864628077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.864670992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.864692926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.864712954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.864741087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.864908934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.950628996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.950686932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.950714111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.950726986 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.950752020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.950762987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951013088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.951057911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.951085091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951092005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.951117039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951133966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951498985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.951551914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.951586962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951596975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.951611042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951620102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.951638937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.952179909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.952220917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.952260017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.952267885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.952296972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.952311039 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.952956915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.953003883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.953046083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.953052998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.953077078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.953095913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.953403950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.953448057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.953480959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.953489065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.953511953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.953528881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.954761982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.954807043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.954857111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.954864979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.954890966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.954900980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.955285072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.955329895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.955363035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.955370903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:57.955394030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:57.955413103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.041182041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.041233063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.041276932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.041287899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.041316986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.041330099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.041695118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.041738987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.041776896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.041785002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.041804075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.041826010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.042222977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.042279959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.042309999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.042316914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.042345047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.042418957 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.042912960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.042979002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.043010950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.043019056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.043045998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.043061972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.043472052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.043514967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.043548107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.043555021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.043569088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.043592930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.044027090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.044090033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.044112921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.044121027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.044147968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.044159889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.045618057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.045663118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.045694113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.045703888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.045727968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.045739889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.046179056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.046221972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.046241999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.046250105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.046264887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.046288013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.338365078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.338391066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.338430882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.338453054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.338496923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.338509083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.338668108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.338989019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339029074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339052916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339061975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339082003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339103937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339610100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339651108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339684010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339690924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339715958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339734077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339890003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339936972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339958906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.339967012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.339993954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340003014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340137005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.340177059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.340200901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340209007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.340228081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340249062 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340883970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.340926886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.340951920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340959072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.340987921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.340998888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.341116905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.341161966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.341178894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.341187954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.341204882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.341218948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.341243982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.341995955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.342036009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.342072010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.342078924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.342114925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.342114925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.342936993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.342978001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343008041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343015909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343050003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343060017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343102932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343146086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343177080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343183994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343204975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343245029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343925953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343965054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.343983889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.343992949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344012022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344028950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344153881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344192982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344224930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344232082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344250917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344274044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344285011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344330072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344346046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344353914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.344379902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.344391108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345009089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345048904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345077991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345086098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345101118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345118999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345645905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345690012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345715046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345722914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345751047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345767975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345849991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345906973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345923901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345932961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.345962048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.345972061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.346620083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.346662045 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.346699953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.346708059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.346735954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.346745968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.346785069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.346828938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.346851110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.346858978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.346885920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.346894026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.347270012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.347309113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.347337008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.347343922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.347364902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.347393036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.347453117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.347495079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.347517967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.347526073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.347546101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.347563028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.348315001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.348356009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.348388910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.348396063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.348427057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.348437071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.348447084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.348476887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.348503113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.348526955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.348541021 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.348603010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349004030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349042892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349082947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349091053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349103928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349127054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349133968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349157095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349186897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349205971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349206924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349231005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.349261045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.349287033 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.404819965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.404891014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.404910088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.404922009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.404952049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.404959917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.405252934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.405301094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.405319929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.405329943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.405356884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.405371904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.405813932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.405862093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.405894995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.405903101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.405920982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.405941963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.406305075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.406354904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.406383038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.406390905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.406418085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.406428099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.406940937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.406981945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.407018900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.407027006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.407042980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.407066107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.407135010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.407198906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.407205105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.407234907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.407263994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.407277107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.409351110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.409408092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.409440041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.409447908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.409476995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.409487009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.410168886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.410219908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.410255909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.410263062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.410279989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.410296917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.495680094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.495728016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.495771885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.495784044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.495805979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.495814085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.496408939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.496464968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.496490955 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.496500015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.496517897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.496536970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497000933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497045040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497071028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497078896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497114897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497133017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497395039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497438908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497478008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497486115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497513056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497525930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497805119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497847080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497881889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497889996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.497906923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.497942924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.498342037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.498384953 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.498414993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.498423100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.498460054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.498471022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.500025988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.500068903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.500122070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.500129938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.500161886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.500180006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.500972033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.501014948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.501060009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.501068115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.501096964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.501105070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.586929083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.586973906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.587018967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.587059975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.587079048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.587188005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.588664055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.588706017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.588736057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.588752031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.588769913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.588798046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589308023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589349985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589373112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589380980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589410067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589418888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589565039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589606047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589648008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589654922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589668036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589693069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589790106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589834929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589853048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589875937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.589880943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589904070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.589920998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.590431929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.590490103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.590519905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.590528011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.590553999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.590570927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.591515064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.591559887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.591586113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.591593027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.591618061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.591630936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.592749119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.592794895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.592834949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.592843056 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.592874050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.592889071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.683842897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.683890104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.683919907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.683932066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.683964014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.683978081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.684732914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.684781075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.684814930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.684822083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.684839010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685049057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685569048 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685611963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685637951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685646057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685669899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685684919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685755014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685796022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685821056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685827971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685844898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685868025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.685945034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.685987949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.686012983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.686019897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.686048985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.686070919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.686491966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.686537027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.686559916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.686567068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.686600924 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.686616898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.687994003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.688035011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.688062906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.688070059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.688097954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.688111067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.689208031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.689251900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.689276934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.689284086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.689311981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.689331055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.775284052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.775355101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.775382996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.775396109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.775428057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.775441885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.775589943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.775631905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.775655985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.775664091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.775702953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.775716066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.776137114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.776185036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.776206970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.776213884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.776242971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.776256084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777070999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777117014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777143002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777149916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777182102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777189970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777757883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777812958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777841091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777848005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777869940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777877092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777909040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777957916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.777971983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.777980089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.778008938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.778037071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.778842926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.778894901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.778920889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.778928041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.778961897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.778980017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.779748917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.779793978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.779823065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.779829979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.779865026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.779881954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.865449905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.865511894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.865536928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.865545988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.865587950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.865602016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.865906954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.865952015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.865973949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.865979910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.866012096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.866023064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.866534948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.866575003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.866597891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.866604090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.866641998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.866661072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.867949009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.867976904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.868084908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.868093014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.868211031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.868233919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.868272066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.868278980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.868300915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.868324995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.869632006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.869651079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.869688988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.869694948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.869724035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.869739056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.869894028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.869914055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.869971037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.869978905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.870296001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.870671034 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.870691061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.870734930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.870742083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.870769024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.870783091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.956029892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.956064939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.956119061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.956130981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.956173897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.956187963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.956496954 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.956516027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.956571102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.956578016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.956605911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.956625938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.957029104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.957047939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.957113028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.957120895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.957168102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.958446026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.958471060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.958530903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.958539009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.958656073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.959168911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.959187031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.959256887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.959263086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.959335089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.959991932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.960010052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.960073948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.960079908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.960108995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.960127115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.963818073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.963857889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.963887930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.963893890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.963927984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.963941097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.964158058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.964206934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.964237928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.964245081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:58.964272022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:58.964287996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.047240973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.047288895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.047322989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.047333956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.047353029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.047377110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.047672987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.047715902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.047735929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.047744036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.047770023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.047790051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.048031092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.048077106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.048105001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.048111916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.048137903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.048161030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.049406052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.049449921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.049506903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.049514055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.049547911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.049561977 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.050223112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.050266027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.050292969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.050299883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.050328970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.050348997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.053900003 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.053946018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.053973913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.053981066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.054008961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.054027081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.057771921 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.057821035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.057852030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.057858944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.057902098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.057913065 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.059514046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.059560061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.059591055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.059597969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.059627056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.059637070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.137943983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.137986898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138021946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138030052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138065100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138083935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138504982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138547897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138591051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138597012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138624907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138638020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138870001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138941050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.138952971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.138981104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.139010906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.139022112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.140360117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.140404940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.140431881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.140438080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.140461922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.140486002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.141773939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.141822100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.141841888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.141848087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.141876936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.141886950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.144526958 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.144570112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.144592047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.144598007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.144625902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.144649029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.148447990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.148504972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.148546934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.148555040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.148581982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.148596048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.150121927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.150168896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.150192976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.150204897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.150314093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.228840113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.228888988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.228926897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.228941917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.228971004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.228998899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.229178905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.229218960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.229243994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.229250908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.229278088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.229293108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.229747057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.229788065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.229820967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.229826927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.229854107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.229873896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.231126070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.231184959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.231200933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.231209993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.231240988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.231256962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.232650042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.232693911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.232724905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.232732058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.232757092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.232775927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.235317945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.235361099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.235394001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.235399961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.235425949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.235450029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.239583969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.239626884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.239658117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.239665031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.239706993 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.239726067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.241482973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.241524935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.241563082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.241569996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.241595984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.241616011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.319564104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.319607019 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.319657087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.319677114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.319691896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.319734097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.319847107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.319901943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.319932938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.319940090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.319962978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.319976091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.320583105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.320626974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.320656061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.320662975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.320688963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.320703983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.321913004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.321957111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.321985960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.321993113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.322020054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.322033882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.323275089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.323317051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.323344946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.323352098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.323378086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.323386908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.326212883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.326256037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.326280117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.326287031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.326313972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.326325893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.330225945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.330271959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.330298901 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.330306053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.330348969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.330360889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.332343102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.332386017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.332417011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.332423925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.332458019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.332467079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.413687944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.413731098 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.413906097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.413906097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.413919926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.413949966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.413988113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.413997889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.414014101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.414026976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.414057016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.414228916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.414272070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.414295912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.414305925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.414329052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.414355040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.414956093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.414999962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.415030003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.415035963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.415049076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.415076017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.415357113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.415399075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.415431023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.415437937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.415462971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.415472031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.417223930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.417268038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.417295933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.417303085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.417330027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.417604923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.420923948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.420969009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.420994997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.421001911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.421026945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.421036959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.432728052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.432770967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.432804108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.432811022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.432961941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.432961941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.504596949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.504667997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.504802942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.504802942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.504813910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.504846096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.504898071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.504966974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.504966974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.504973888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.505167961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.505307913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.505382061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.505436897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.505466938 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.505474091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.505491972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.505515099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.507921934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.507966042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.507997990 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.508004904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.508222103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.508222103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.508290052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.508351088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.508359909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.508382082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.508408070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.508418083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.513217926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.513269901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.513421059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.513428926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.513741016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.516736031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.516791105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.516818047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.516824961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.516850948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.516866922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.524275064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.524324894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.524370909 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.524379015 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.524410009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.524424076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.595088005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595146894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595181942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.595196009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595228910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.595247984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.595741987 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595793009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595827103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.595838070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595864058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.595944881 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.595998049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.596016884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.596025944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.596069098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.598978996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.599026918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.599051952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.599061966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.599088907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.599107981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.599555016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.599601030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.599633932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.599641085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.599666119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.599685907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.603909969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.603957891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.603985071 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.603991985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.604020119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.604031086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.607448101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.607492924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.607522011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.607528925 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.607551098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.607572079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.615632057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.615689993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.615721941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.615730047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.615757942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.615767956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.686192989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.686244011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.686274052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.686290026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.686311007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.686322927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.686621904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.686664104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.686695099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.686702013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.686729908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.686745882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.687099934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.687141895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.687180996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.687186956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.687212944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.687227011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.689773083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.689817905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.689847946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.689855099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.689883947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.689897060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.690176010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.690222025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.690248013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.690254927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.690279007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.690294027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.695045948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.695086002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.695122004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.695132017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.695158958 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.695175886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.698745966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.698791981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.698822975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.698829889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.698860884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.698874950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.711208105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.711255074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.711291075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.711303949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.711319923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.711338997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.776849031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.776895046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.776922941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.776936054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.776951075 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777008057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777231932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.777272940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.777297974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777303934 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.777332067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777343988 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777808905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.777857065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.777882099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777889013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.777916908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.777930975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.780749083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.780793905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.780824900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.780831099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.780855894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.780870914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.781219959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.781263113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.781277895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.781286955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.781308889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.781322956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.785510063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.785557032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.785597086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.785604000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.785631895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.785650015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.789488077 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.789544106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.789587021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.789594889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.789622068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.789634943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.801981926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.802030087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.802062035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.802079916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.802100897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.802125931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.867935896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.868010044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.868177891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.868191957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.868674040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.868741035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.868798018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.868824005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.868830919 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.868856907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.868870974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.869040966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.869086027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.869101048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.869108915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.869138956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.869149923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.871913910 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.871957064 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.871990919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.871998072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.872021914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.872036934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.872571945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.872621059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.872653961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.872661114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.872687101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.872700930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.876472950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.876532078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.876550913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.876558065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.876580954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.876594067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.881108999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.881155014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.881196022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.881202936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.881232023 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.881247044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.892990112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.893044949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.893073082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.893084049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.893110037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.893122911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.958686113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.958740950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.958785057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.958806038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.958818913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959039927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959219933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.959266901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.959295034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959301949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.959330082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959343910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959785938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.959840059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.959877014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959882975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.959908009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.959925890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.962279081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.962330103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.962363005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.962368965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.962397099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.962421894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.962614059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.962655067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.962682962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.962690115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.962716103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.962733984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.967001915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.967068911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.967082024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.967099905 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.967133045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.967154026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.971509933 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.971554995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.971610069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.971617937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.971652985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.971668959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.983838081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.983895063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.983938932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.983946085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:39:59.983973980 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:39:59.983988047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.057631969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.057682037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.057706118 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.057722092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.057746887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.057765007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.058310032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.058350086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.058376074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.058382988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.058409929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.058419943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.058708906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.058753967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.058783054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.058789968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.058820963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.058835030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.060264111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.060305119 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.060337067 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.060343981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.060370922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.060389996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.060749054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.060791969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.060830116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.060837030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.060864925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.060878038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.065939903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.065983057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.066003084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.066010952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.066039085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.066052914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.073596001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.073621988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.073656082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.073663950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.073693991 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.073717117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.148262978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.148287058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.148370981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.148386955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.148519993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.148552895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.148580074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.148586988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.148605108 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.148633003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.149024010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.149049997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.149097919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.149105072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.149133921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.149158001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.149359941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.149379969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.149413109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.149420023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.149445057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.149463892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.150988102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.151006937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.151068926 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.151077032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.151576996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.151608944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.151644945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.151653051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.151671886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.151700020 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.156796932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.156817913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.156881094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.156889915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.158404112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.164395094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.164414883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.164457083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.164465904 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.164475918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.164504051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.238842964 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.238863945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239092112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239118099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239166975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239289999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239314079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239346981 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239352942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239378929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239388943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239752054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239773035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239808083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239814997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.239842892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.239857912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.240257978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.240278959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.240312099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.240319014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.240338087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.240358114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.241672993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.241694927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.241725922 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.241734028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.241772890 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.241846085 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.242228985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.242249012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.242281914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.242290974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.242326021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.242399931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.247674942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.247704029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.247777939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.247786999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.251773119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.255125046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.255146027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.255209923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.255218983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.259797096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330018997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330079079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330130100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330157995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330182076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330296993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330346107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330363989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330379963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330419064 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330440998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330497026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330543995 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330564976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330579042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.330605984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.330625057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.331077099 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.331125975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.331149101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.331162930 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.331187963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.331208944 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.333051920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.333102942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.333142042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.333178997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.333204985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.333224058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.333576918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.333626032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.333657026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.333672047 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.333698034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.333715916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.338524103 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.338576078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.338630915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.338654041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.338680983 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.338700056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.345977068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.346023083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.346065044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.346081018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.346110106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.346127987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.420860052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.420924902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421096087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.421118975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421145916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421197891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421217918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.421235085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421267986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.421295881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.421399117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421443939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421471119 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.421483994 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.421518087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.421535969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434041977 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434111118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434151888 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434181929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434206963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434247971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434298992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434320927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434335947 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434367895 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434391022 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434464931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434514046 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434545994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434582949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.434612989 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.434637070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.435297012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.435339928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.435385942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.435405016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.435431004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.435647011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.436784983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.436830044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.436865091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.436878920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.436909914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.436929941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.513402939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.513468027 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.513629913 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.513674974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.513720036 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.513768911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.513793945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.513816118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.513842106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.513842106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.513869047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.514626980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.514667988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.514707088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.514720917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.514746904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.515002012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.524781942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.524862051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.524995089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.524996042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.525023937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525098085 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525151014 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525173903 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.525182962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525218010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.525243044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.525567055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525609016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525650978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.525656939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.525670052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.525697947 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.526222944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.526273966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.526309013 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.526315928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.526336908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.526356936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.527456999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.527503967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.527533054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.527539968 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.527568102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.527578115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.613512993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.613571882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.613629103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.613713980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.613754034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.613779068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.613841057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.613908052 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.614000082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.614020109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.614047050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.614078045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.614515066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.614556074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.614676952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.614695072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.614754915 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.626002073 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.626051903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.626079082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.626107931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.626132965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.626154900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.626530886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.626574993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.626643896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.626658916 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.626705885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.626743078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.627127886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.627192020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.627211094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.627224922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.627254009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.627271891 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.627414942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.627465010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.627489090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.627504110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.627528906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.627548933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.629889011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.629941940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.629977942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.629990101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.630105972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.713340998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.713393927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.713469028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.713505030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.713535070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.713578939 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.713761091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.713809013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.713836908 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.713849068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.713876963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.713901997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.714214087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.714271069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.714309931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.714322090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.714348078 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.714579105 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.719050884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.719100952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.719137907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.719149113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.719176054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.719194889 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.719587088 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.719633102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.719669104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.719679117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.719708920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.719737053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.720283031 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.720324993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.720376968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.720392942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.720418930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.720524073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.720840931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.720885992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.720926046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.720937967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.720963001 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.720989943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.721868992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.721918106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.721951008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.721961975 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.721987963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.722007036 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.804394960 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.804445028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.804550886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.804584026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.804626942 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.804656982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.804734945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.804754972 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.804800987 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.804806948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.804832935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.804846048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.805075884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.805099010 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.805146933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.805152893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.805175066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.805191994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.809736967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.809762955 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.809899092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.809911013 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.810337067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.810362101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.810425997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.810431957 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.810446024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.810473919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.810806990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.810827017 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.810887098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.810893059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.811233044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.811255932 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.811311007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.811319113 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.811794996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.812228918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.812247992 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.812297106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.812303066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.812323093 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.812345982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.894865990 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.894887924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895018101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.895032883 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895370007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895399094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895443916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.895452023 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895468950 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.895500898 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.895801067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895819902 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.895890951 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.895898104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.899795055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.900470018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.900499105 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.900562048 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.900568008 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.901176929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.901212931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.901256084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.901268959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.901288986 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.901316881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.901726961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.901746035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.901810884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.901817083 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.902266979 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.902290106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.902338028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.902344942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.902369976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.902389050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.902955055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.902971983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.903027058 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.903033018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.903799057 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.985786915 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.985821009 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.985915899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.985934973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.985964060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.985980034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.986413002 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.986433029 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.986488104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.986495018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.986994982 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.987020969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.987072945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.987080097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.987104893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.987132072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.991373062 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.991391897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.991461992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.991468906 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.991794109 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992026091 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.992044926 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.992090940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992096901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.992111921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992141962 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992510080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.992530107 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.992579937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992587090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.992624044 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992636919 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.992988110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.993011951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.993057966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.993062973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.993077040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.993107080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.993704081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.993735075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.993796110 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:00.993802071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:00.995791912 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.084261894 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.084290981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.084356070 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.084368944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.084379911 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.084408045 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.085303068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.085325956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.085391998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.085411072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.085804939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.085829020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.085874081 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.085881948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.085912943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.085932970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.090903044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.090922117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.091001034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.091007948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.091371059 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.091393948 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.091447115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.091453075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.091480017 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.091504097 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.091928959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.091948032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.092016935 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.092022896 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.092504025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.092525959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.092572927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.092578888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.092602015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.092628956 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.093444109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.093462944 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.093524933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.093530893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.095793009 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.175147057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.175180912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.175246954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.175262928 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.175277948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.175306082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.176139116 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.176157951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.176230907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.176238060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.176285028 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.176601887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.176631927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.176665068 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.176671028 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.176698923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.176721096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.184003115 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.184022903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.184068918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.184075117 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.184098959 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.184125900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.185848951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.185870886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.185925961 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.185930967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.185973883 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.186463118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.186495066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.186528921 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.186534882 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.186547995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.186568975 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.187793970 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.187813997 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.187872887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.187877893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.187902927 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.187931061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.190331936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.190357924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.190401077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.190407038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.190438032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.190447092 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.273324966 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.273355961 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.273427963 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.273443937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.273463011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.273480892 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.273617983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.273639917 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.273682117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.273689032 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.273713112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.273746014 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.274137974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.274158001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.274194002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.274202108 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.274223089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.274235964 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.275249004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.275269985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.275316954 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.275322914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.275345087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.275357008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.277173042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.277196884 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.277240992 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.277250051 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.277283907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.277323008 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.277555943 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.277607918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.277620077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.277627945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.277653933 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.277673960 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.279268980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.279289007 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.279336929 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.279342890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.279369116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.279385090 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.281224012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.281244993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.281289101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.281295061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.281320095 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.281335115 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364121914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364176989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364228010 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364259005 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364274979 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364300966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364375114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364418030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364428043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364449024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364475012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364501953 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364836931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364878893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364901066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364909887 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.364938021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.364953995 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.365890980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.365932941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.365966082 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.365973949 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.365998030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.366008997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.370167971 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.370244980 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.370245934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.370270967 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.370306015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.370316029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.370616913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.370686054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.370732069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.370795965 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.370922089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.370979071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.371016026 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.371028900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.371049881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.371049881 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.371072054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.372661114 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.372682095 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.372740030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.372750044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.372790098 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.461932898 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.461998940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.462202072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.462239027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.462279081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.462307930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.462351084 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.462652922 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.462692976 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.462722063 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.462730885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.462745905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.462775946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.463687897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.463731050 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.463767052 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.463777065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.463792086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.463823080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.465271950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.465313911 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.465348005 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.465356112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.465369940 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.465392113 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.465779066 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.465825081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.465852976 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.465861082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.465876102 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.465908051 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.466521025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.466562033 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.466589928 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.466598988 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.466617107 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.466645002 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.466959000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.467004061 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.467035055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.467042923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.467061043 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.467080116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.552892923 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.552932978 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.553003073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.553040981 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.553059101 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.553091049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.553364038 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.553407907 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.553438902 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.553447962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.553473949 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.553484917 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.555819035 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.555861950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.555891037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.555906057 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.555922031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.555944920 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.556286097 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.556324959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.556369066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.556377888 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.556395054 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.556420088 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.556767941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.556811094 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.556843996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.556852102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.556869030 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.556898117 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.557315111 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.557368040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.557408094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.557415962 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.557445049 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.557456970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.557652950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.557698011 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.557729006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.557735920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.557753086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.557777882 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.558010101 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.558054924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.558082104 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.558089018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.558108091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.558125019 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.647707939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.647753000 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.647809982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.647834063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.647849083 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.647876024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.648004055 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.648047924 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.648108006 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.648116112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.648159027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.648159027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.653640985 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.653685093 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.653743029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.653754950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.653789997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.653810024 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654261112 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654303074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654341936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654350042 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654386997 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654418945 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654658079 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654696941 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654736042 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654747963 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654761076 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654789925 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654882908 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654927969 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654947996 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654956102 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.654985905 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.654995918 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.655497074 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.655534983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.655575037 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.655581951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.655602932 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.655617952 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.655994892 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.656035900 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.656069994 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.656078100 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.656090021 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.656115055 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.738465071 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.738534927 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.738564968 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.738578081 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.738606930 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.738616943 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.738688946 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.738735914 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.738755941 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.738765001 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.738786936 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.738818884 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.744270086 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.744314909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.744349003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.744357109 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.744388103 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.744405031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.744734049 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.744786024 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.744812012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.744821072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.744852066 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.744862080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.745353937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.745409012 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.745439053 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.745446920 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.745476007 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.745484114 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.745661974 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.745704889 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.745732069 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.745738983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.745764971 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.745784998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.746082067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.746134043 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.746159077 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.746166945 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.746181011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.746206999 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.746336937 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.746381998 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.746404886 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.746412039 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.746442080 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.746454000 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.829058886 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.829112053 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.829139948 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.829158068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.829171896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.829201937 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.829523087 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.829566956 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.829602003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.829611063 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.829638004 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.829653978 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.834976912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835021973 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835051060 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835066080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835081100 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835103035 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835515022 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835573912 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835582972 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835602999 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835632086 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835642099 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835834026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835877895 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835892916 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835902929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.835922003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.835938931 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836128950 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.836169004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.836189985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836198092 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.836222887 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836237907 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836435080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.836477041 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.836494923 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836512089 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.836519003 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836539984 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.836554050 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.837171078 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.837213993 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.837234974 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.837243080 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.837275982 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.837292910 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.920124054 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.920178890 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.920209885 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.920238018 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.920253038 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.920278072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.920572996 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.920617104 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.920655012 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.920663118 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.920691967 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.920702934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.925682068 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.925726891 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.925770998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.925780058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.925820112 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.925828934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.926297903 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.926351070 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.926381111 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.926388025 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.926413059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.926423073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.926510096 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.926554918 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.926568985 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.926579952 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.926606894 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.926621914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.927093983 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.927139044 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.927174091 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.927181959 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.927208900 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.927220106 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.927484989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.927526951 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.927551031 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.927558899 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.927586079 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.927593946 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.928319931 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.928360939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.928389072 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.928396940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:01.928426027 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:01.928435087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.010854006 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.010942936 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.011090040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.011110067 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.011159897 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.011193037 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.011241913 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.011270046 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.011279106 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.011296034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.011316061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.016277075 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.016323090 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.016362906 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.016371965 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.016388893 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.016406059 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.016905069 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.016951084 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.016978025 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.016985893 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017013073 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017251015 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017287016 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017338991 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017390966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017400026 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017415047 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017445087 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017643929 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017690897 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017712116 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017720938 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.017755032 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.017762899 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.018121004 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.018166065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.018194914 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.018203020 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.018233061 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.018251896 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.018938065 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.018990040 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.019026041 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.019033909 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.019061089 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.019078016 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.101775885 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.101844072 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.101895094 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.101922989 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.101943970 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.101965904 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.102026939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.102068901 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.102091074 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.102098942 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.102118969 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.102142096 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107314110 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107363939 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107403040 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107418060 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107434034 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107465029 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107469082 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107501030 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107522011 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107547998 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107557058 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107605934 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.107641935 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:02.107696056 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.108155966 CEST	49709	443	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:02.108171940 CEST	443	49709	212.102.56.179	192.168.2.5
Jun 22, 2024 06:40:04.262478113 CEST	49708	80	192.168.2.5	212.102.56.179
Jun 22, 2024 06:40:11.671977997 CEST	49717	80	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:11.676786900 CEST	80	49717	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:11.679832935 CEST	49717	80	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:11.680008888 CEST	49717	80	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:11.684722900 CEST	80	49717	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:12.309849024 CEST	80	49717	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:12.312422991 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:12.312541008 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:12.312625885 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:12.330439091 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:12.330476999 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:12.361166000 CEST	49717	80	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:13.002074957 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:13.002226114 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:13.008272886 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:13.008305073 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:13.008858919 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:13.051052094 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:13.092504978 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:13.273333073 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:13.273426056 CEST	443	49718	156.146.33.138	192.168.2.5
Jun 22, 2024 06:40:13.273535967 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:40:13.277103901 CEST	49718	443	192.168.2.5	156.146.33.138
Jun 22, 2024 06:41:52.323277950 CEST	49717	80	192.168.2.5	156.146.33.138
Jun 22, 2024 06:41:52.328851938 CEST	80	49717	156.146.33.138	192.168.2.5
Jun 22, 2024 06:41:52.328947067 CEST	49717	80	192.168.2.5	156.146.33.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2024 06:39:36.342164040 CEST	61267	53	192.168.2.5	1.1.1.1
Jun 22, 2024 06:39:36.353173018 CEST	53	61267	1.1.1.1	192.168.2.5
Jun 22, 2024 06:40:07.685950041 CEST	51919	53	192.168.2.5	1.1.1.1
Jun 22, 2024 06:40:11.655944109 CEST	61031	53	192.168.2.5	1.1.1.1
Jun 22, 2024 06:40:11.667253017 CEST	53	61031	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 22, 2024 06:39:36.342164040 CEST	192.168.2.5	1.1.1.1	0xedbf	Standard query (0)	static.adtidy.net	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:07.685950041 CEST	192.168.2.5	1.1.1.1	0xd65c	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.655944109 CEST	192.168.2.5	1.1.1.1	0xb85	Standard query (0)	static.adguard.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	static.adtidy.net	1523296349.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		212.102.56.179	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		156.146.33.137	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		212.102.56.181	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		156.146.33.14	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		195.181.175.15	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:39:36.353173018 CEST	1.1.1.1	192.168.2.5	0xedbf	No error (0)	1523296349.rsc.cdn77.org		156.146.33.141	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:07.692986965 CEST	1.1.1.1	192.168.2.5	0xd65c	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	static.adguard.com	1625341327.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		156.146.33.138	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		156.146.33.15	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		156.146.33.140	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		212.102.56.182	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		195.181.175.15	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:40:11.667253017 CEST	1.1.1.1	192.168.2.5	0xb85	No error (0)	1625341327.rsc.cdn77.org		212.102.56.178	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

static.adtidy.net

static.adguard.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	212.102.56.179	80	5856	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Timestamp	Bytes transferred	Direction	Data
Jun 22, 2024 06:39:36.364862919 CEST	103	OUT	GET /windows/installer.exe HTTP/1.1 User-Agent: AdGuard VPN Web Installer Host: static.adtidy.net
Jun 22, 2024 06:39:36.997765064 CEST	1125	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 22 Jun 2024 04:39:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://static.adtidy.net/windows/installer.exe Server: CDN77-Turbo X-77-NZT: EQgB1GY4sQAA X-77-NZT-Ray: 1cb09c0e728f4cd0885576663d9fff35 X-77-POP: frankfurtDE X-77-Cache: MISS Data Raw: 33 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 63 2e 63 64 6e 37 37 2e 6f 72 67 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 28 63 29 20 32 30 32 33 20 43 44 4e 37 37 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c [TRUNCATED] Data Ascii: 304<!DOCTYPE html><head> <base href="https://error.c.cdn77.org/" target="_blank"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="author" content="(c) 2023 CDN77"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="css/main.css"> <link rel="shortcut icon" href="img/favicon.ico" /> <title>Moved Permanently</title></head><body style="background-color: #0d5284; color: #fff;" class="Header-wrap"> <h1> <small class="Header-errorNumber"> 301 Redirect</small><br> Moved Permanently </h1> <p class="Header-description"> This resource has been permanently moved to a new location.</p></body>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	156.146.33.138	80	4788	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Timestamp	Bytes transferred	Direction	Data
Jun 22, 2024 06:40:11.680008888 CEST	87	OUT	GET /installer.v1.0.json HTTP/1.1 Host: static.adguard.com Connection: Keep-Alive
Jun 22, 2024 06:40:12.309849024 CEST	1124	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 22 Jun 2024 04:40:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://static.adguard.com/installer.v1.0.json Server: CDN77-Turbo X-77-NZT: EQgBnJIhiAAA X-77-NZT-Ray: f6587a1dc2f10541ac557666454e260d X-77-POP: frankfurtDE X-77-Cache: MISS Data Raw: 33 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 63 2e 63 64 6e 37 37 2e 6f 72 67 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 28 63 29 20 32 30 32 33 20 43 44 4e 37 37 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c [TRUNCATED] Data Ascii: 304<!DOCTYPE html><head> <base href="https://error.c.cdn77.org/" target="_blank"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="author" content="(c) 2023 CDN77"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="css/main.css"> <link rel="shortcut icon" href="img/favicon.ico" /> <title>Moved Permanently</title></head><body style="background-color: #0d5284; color: #fff;" class="Header-wrap"> <h1> <small class="Header-errorNumber"> 301 Redirect</small><br> Moved Permanently </h1> <p class="Header-description"> This resource has been permanently moved to a new location.</p></body>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	212.102.56.179	443	5856	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 04:39:38 UTC	127	OUT	GET /windows/installer.exe HTTP/1.1 User-Agent: AdGuard VPN Web Installer Host: static.adtidy.net Connection: Keep-Alive
2024-06-22 04:39:38 UTC	671	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 04:39:38 GMT Content-Type: application/x-msdos-program Content-Length: 33343848 Connection: close Last-Modified: Wed, 15 May 2024 00:27:21 GMT x-rgw-object-type: Normal ETag: "b005e4007eb93f23bb0e7f03fb634d46" x-amz-request-id: tx00000320fe9a91d2bbc7f-006675a1ce-64e5e44-prg X-77-NZT: A9RmOLE3Nzf/tgQAACUTwjE3Nzf/qQsAAG09Wg6mQHMA X-77-NZT-Ray: 1cb09c0e1788fbe98a5576664b86ac15 X-Accel-Expires: @1719042836 X-Accel-Date: 1719029972 X-77-Cache: HIT X-77-Age: 1206 Server: CDN77-Turbo Alt-Svc: h3=":443"; ma=86400 X-Accel-Date-Max: 1718988151 X-Cache: HIT X-Age: 1206 X-77-POP: frankfurtDE Accept-Ranges: bytes
2024-06-22 04:39:38 UTC	15713	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 0a 6f fb 7d 6b 01 a8 7d 6b 01 a8 7d 6b 01 a8 c9 f7 f0 a8 77 6b 01 a8 c9 f7 f2 a8 00 6b 01 a8 c9 f7 f3 a8 65 6b 01 a8 2f 03 05 a9 6e 6b 01 a8 2f 03 02 a9 69 6b 01 a8 2f 03 04 a9 56 6b 01 a8 74 13 82 a8 78 6b 01 a8 74 13 92 a8 6c 6b 01 a8 7d 6b 00 a8 28 6a 01 a8 eb 02 04 a9 36 6b 01 a8 eb 02 fe a8 7c 6b 01 a8 7d 6b 96 a8 7f 6b 01 a8 eb 02 03 a9 7c 6b 01 a8 52 69 63 68 7d 6b 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9o}k}k}kwkkek/nk/ik/Vktxktlk}k(j6k\|k}kk\|kRich}k
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 00 e9 27 01 00 00 ff 15 a0 a1 44 00 89 87 98 04 00 00 83 f8 ff 75 38 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 4c 02 00 00 68 8c aa 44 00 e8 14 ef ff ff 68 fc ae 44 00 e9 de 00 00 00 ff b7 b0 04 00 00 50 ff 15 a8 a1 44 00 85 c0 75 38 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 51 02 00 00 68 8c aa 44 00 e8 cb ee ff ff 68 38 af 44 00 e9 95 00 00 00 57 68 9e 45 40 00 e8 5d b5 03 00 57 ff 75 08 e8 c1 9e 01 00 8b f0 85 f6 79 07 68 d8 ad 44 00 eb 74 6a 01 e8 f0 ca 03 00 8d 47 18 50 8d 87 f8 00 00 00 50 8d 45 f8 50 8d 45 fc 50 8d 87 b8 00 00 00 50 8d 87 00 01 00 00 50 8d 87 88 00 00 00 50 8d 87 b8 02 00 00 50 8d 87 c0 02 00 00 50 8d 87 a8 02 00 00 50 8d 87 Data Ascii: 'Du8D~x@VhLhDhDPDu8D~x@VhQhDh8DWhE@]WuyhDtjGPPEPEPPPPPPP
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 2f 8b 4d 0c 8b 45 10 23 4d 14 23 45 18 0b c8 eb e9 8b 4d 0c 8b 45 10 0f ac c1 10 0f b7 c1 eb 04 0f b7 45 0c 3b 45 14 75 05 3b 55 18 74 ce 8b ca 8b 45 1c 89 08 eb 05 ba 57 00 07 80 8b c2 5d c2 18 00 90 c8 88 40 00 fd 88 40 00 15 89 40 00 29 89 40 00 3d 89 40 00 4d 89 40 00 62 89 40 00 72 89 40 00 81 89 40 00 fd 88 40 00 15 89 40 00 29 89 40 00 3d 89 40 00 4d 89 40 00 62 89 40 00 72 89 40 00 81 89 40 00 55 8b ec 51 53 56 8b 35 04 a1 44 00 33 db 57 8b 7d 08 8b c7 ff 75 0c c1 e8 11 83 e0 01 89 45 fc ff d6 ff 75 10 89 45 08 ff d6 8b f0 81 ff 0a 00 03 00 7f 5f 81 ff 05 00 03 00 7d 2c 81 ff 05 00 01 00 7c 61 81 ff 0a 00 01 00 7e 1c 81 ff 0b 00 01 00 0f 84 96 00 00 00 81 ff 0c 00 01 00 74 67 81 ff 0d 00 01 00 eb 3b 56 ff 75 10 ff 75 08 ff 75 0c ff 75 fc 6a 7f ff Data Ascii: /ME#M#EMEE;Eu;UtEW]@@@)@=@M@b@r@@@@)@=@M@b@r@@UQSV5D3W}uEuE_},\|a~tg;Vuuuuj
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 6a 76 68 e4 ea 44 00 e8 35 6f ff ff ff 77 08 68 c0 eb 44 00 56 e8 76 31 03 00 83 c4 0c eb 14 68 98 eb 44 00 eb 05 68 6c eb 44 00 56 e8 5f 31 03 00 59 59 5f 8b c6 5e 5b c9 c2 08 00 55 8b ec 56 8b 75 08 8b 06 85 c0 74 66 53 33 db 39 5e 04 76 57 33 c0 89 45 08 57 8b 3e 03 f8 83 7f 0c 00 74 0d ff 77 0c ff 15 e0 a0 44 00 83 67 0c 00 83 3f 00 74 07 ff 37 e8 6f 5d ff ff 83 7f 08 00 74 08 ff 77 08 e8 61 5d ff ff 83 7f 04 00 74 08 ff 77 04 e8 53 5d ff ff 8b 45 08 43 83 c0 10 89 45 08 3b 5e 04 72 b2 8b 06 5f 50 e8 7d 70 ff ff 5b 83 26 00 83 66 04 00 5e 5d c2 04 00 55 8b ec 83 ec 0c 56 57 8d 45 f4 33 ff 50 68 90 ea 44 00 ff 75 0c 89 7d f4 89 7d fc 89 7d f8 e8 2b 67 03 00 8b f0 85 f6 79 12 68 a0 Data Ascii: ~x@VjvhD5owhDVv1hDhlDV_1YY_^[UVutfS39^vW3EW>twDg?t7o]twa]twS]ECE;^r_P}p[&f^]UVWE3PhDu}}}+gyh
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 39 5e 60 74 08 ff 76 60 e8 f4 1d ff ff 39 5e 64 74 08 ff 76 64 e8 e7 1d ff ff 39 5e 68 74 08 ff 76 68 e8 da 1d ff ff 39 5e 6c 74 08 ff 76 6c e8 cd 1d ff ff 39 5e 70 74 08 ff 76 70 e8 c0 1d ff ff 39 5e 74 74 08 ff 76 74 e8 b3 1d ff ff 39 5e 78 74 08 ff 76 78 e8 a6 1d ff ff 39 5e 7c 74 08 ff 76 7c e8 99 1d ff ff 8b 86 80 00 00 00 85 c0 74 06 50 e8 89 1d ff ff 8b 86 84 00 00 00 85 c0 74 06 50 e8 79 1d ff ff 8b 86 a0 00 00 00 85 c0 74 06 50 e8 69 1d ff ff 8b 86 a4 00 00 00 85 c0 74 06 50 e8 59 1d ff ff 8b 86 a8 00 00 00 85 c0 74 06 50 e8 49 1d ff ff 8b 86 ac 00 00 00 85 c0 74 06 50 e8 39 1d ff ff 8b 86 b0 00 00 00 85 c0 74 06 50 e8 29 1d ff ff 8b 86 94 00 00 00 85 c0 74 79 39 9e 98 00 00 00 76 69 33 ff 8b 14 38 8b c8 85 d2 74 0e 52 e8 06 1d ff ff 8b 86 94 00 Data Ascii: 9^`tv`9^dtvd9^htvh9^ltvl9^ptvp9^ttvt9^xtvx9^\|tv\|tPtPytPitPYtPItP9tP)ty9vi38tR
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 56 68 18 03 00 00 68 a4 33 45 00 e8 49 ef fe ff 68 90 3a 45 00 56 e8 8d b1 02 00 59 59 eb 62 33 c9 33 c0 33 f6 89 4d f4 89 45 f8 46 eb 9a 6a 00 8d 4d fc 51 ff 77 04 50 ff 75 08 ff 15 fc a1 44 00 85 c0 75 35 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 27 03 00 00 68 a4 33 45 00 e8 e6 ee fe ff 68 dc 3a 45 00 eb 9b c7 47 08 01 00 00 00 83 7f 08 00 75 0e 83 7f 0c 00 74 08 ff 77 0c e8 ae f0 fe ff 5f 8b c6 5e 5b c9 c2 08 00 55 8b ec 51 51 56 57 8d 45 fc 33 ff 50 8d 45 f8 89 7d f8 50 ff 75 14 89 7d fc ff 75 10 ff 75 0c e8 aa fb ff ff 8b f0 85 f6 79 07 68 40 3a 45 00 eb 61 89 7d 14 39 7d fc 76 61 6a 00 8d 45 14 50 8b 45 fc 2b c7 50 ff 75 f8 ff 75 08 ff 15 3c a1 44 00 85 c0 74 0a 03 7d 14 3b 7d fc 72 dc eb 3b ff Data Ascii: Vhh3EIh:EVYYb333MEFjMQwPuDu5D~x@Vh'h3Eh:EGutw_^[UQQVWE3PE}Pu}uuyh@:Ea}9}vajEPE+Puu<Dt};}r;
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 39 75 08 0f 84 30 01 00 00 39 35 78 aa 46 00 75 63 8d 45 fc 50 6a 23 e8 2b ac fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 70 62 45 00 e9 84 01 00 00 bf 78 aa 46 00 57 68 e0 53 45 00 ff 75 fc e8 b0 a4 fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 9c 62 45 00 e9 5c 01 00 00 57 e8 3e a2 fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 d8 62 45 00 e9 41 01 00 00 a1 7c aa 46 00 85 c0 75 68 bf 7c aa 46 00 57 56 68 20 63 45 00 68 38 53 45 00 e8 77 c6 02 00 8b d8 85 db 79 12 68 3c 63 45 00 53 e8 04 71 02 00 59 59 e9 13 01 00 00 39 35 7c aa 46 00 74 13 57 e8 e4 a1 fe ff 8b d8 85 db 79 21 68 70 63 45 00 eb d8 56 ff 35 78 aa 46 00 57 e8 6a 98 fe ff 8b d8 85 db 79 07 68 c8 63 45 00 eb be a1 7c aa 46 00 39 75 0c 75 05 a1 78 aa 46 00 56 8b 75 10 50 56 e8 43 98 fe ff 8b d8 85 db 79 Data Ascii: 9u095xFucEPj#+yhtWEhpbExFWhSEuyhtWEhbE\W>yhtWEhbEA\|Fuh\|FWVh cEh8SEwyh<cESqYY95\|FtWy!hpcEV5xFWjyhcE\|F9uuxFVuPVCy
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 50 8d 45 fc 50 ff 77 04 ff 77 0c e8 d9 25 02 00 8b f0 85 f6 79 07 68 00 7f 45 00 eb 96 8b 45 f8 6a 01 c1 e0 02 50 e8 53 70 fe ff 8b d8 85 db 75 1f be 0e 00 07 80 56 68 f0 04 00 00 68 b0 6e 45 00 e8 13 6f fe ff 68 1c 7f 45 00 e9 63 ff ff ff 33 c0 89 45 08 8b 45 f8 85 c0 74 32 8b d3 89 5d f0 52 8d 45 fc 50 ff 77 04 ff 77 0c e8 d1 25 02 00 8b f0 85 f6 78 6e 8b 4d 08 8b 55 f0 41 8b 45 f8 83 c2 04 89 4d 08 89 55 f0 3b c8 72 d3 89 45 e8 89 5d ec 8b 45 0c 8d 4d e0 ff 70 04 51 ff 10 8b 4d 10 89 01 83 7d f4 00 74 08 ff 75 f4 e8 4e 5d fe ff 85 db 74 25 8b 45 f8 85 c0 74 18 33 ff 83 3c bb 00 74 0b ff 34 bb e8 33 5d fe ff 8b 45 f8 47 3b f8 72 ea 53 e8 67 70 fe ff 5f 8b c6 5e 5b c9 c2 0c 00 8b 45 08 50 68 48 7f 45 00 56 e8 b4 30 02 00 83 c4 0c eb ac 8d 45 e8 c7 45 e0 Data Ascii: PEPww%yhEEjPSpuVhhnEohEc3EEt2]REPww%xnMUAEMU;rE]EMpQM}tuN]t%Et3<t43]EG;rSgp_^[EPhHEV0EE
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: e8 01 74 0c bf 9f 13 07 80 68 c0 a1 45 00 eb 72 8b 43 44 2b 43 48 56 8b 75 10 56 ff 75 0c 50 8b 43 40 03 43 48 50 e8 ec 32 fe ff 83 c4 10 01 73 48 89 75 fc 5e eb 53 57 8d 45 fc 50 ff 75 10 ff 75 0c ff 73 3c ff 15 3c a1 44 00 85 c0 75 3b ff 15 f4 a0 44 00 8b f8 85 ff 7e 0b 0f b7 ff 81 cf 00 00 07 80 85 ff 78 05 bf 05 40 00 80 57 68 04 03 00 00 68 28 9d 45 00 e8 dc 2e fe ff 68 94 a1 45 00 57 e8 20 f1 01 00 59 59 89 7b 30 85 ff 5f 5b 79 05 83 c8 ff c9 c3 8b 45 fc c9 c3 55 8b ec 83 ec 10 56 57 8b 7d 08 33 f6 89 75 f0 89 75 f4 89 75 f8 8b 47 2c 48 89 75 fc 83 e8 01 74 3a 83 e8 01 0f 84 80 00 00 00 48 83 e8 01 74 24 be 9f 13 07 80 56 68 96 02 00 00 68 28 9d 45 00 e8 76 2e fe ff 68 d8 9f 45 00 56 e8 ba f0 01 00 59 59 eb 56 be 04 40 00 80 eb 4f 8b 4d 0c 8d 45 f0 Data Ascii: thErCD+CHVuVuPC@CHP2sHu^SWEPuus<<Du;D~x@Whh(E.hEW YY{0_[yEUVW}3uuuG,Hut:Ht$Vhh(Ev.hEVYYV@OME
2024-06-22 04:39:38 UTC	16384	IN	Data Raw: 50 e8 78 f0 fd ff 89 87 bc 00 00 00 85 c0 75 1f bf 0e 00 07 80 57 6a 62 68 10 ad 45 00 8b f7 e8 35 ef fd ff 68 44 ad 45 00 57 e9 ef fe ff ff 8b 45 f4 83 65 08 00 89 87 c0 00 00 00 85 c0 0f 84 50 01 00 00 33 c9 89 4d ec 8b 87 bc 00 00 00 03 c1 89 45 0c 8d 45 fc 6a 00 50 ff 75 f8 e8 1f e7 01 00 8b f0 85 f6 0f 88 a3 01 00 00 ff 75 0c 68 64 bb 44 00 ff 75 fc e8 80 e1 01 00 8b f0 85 f6 0f 88 7f 01 00 00 8b 45 0c 83 c0 04 50 68 78 ad 45 00 ff 75 fc e8 62 e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 1d 01 00 00 8b 45 0c 83 c0 08 50 68 c0 ad 45 00 ff 75 fc e8 3c e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 01 01 00 00 8b 45 0c 83 c0 0c 50 68 0c ae 45 00 ff 75 fc e8 16 e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 e5 00 00 00 8b 45 0c 83 c0 10 50 Data Ascii: PxuWjbhE5hDEWEeP3MEEjPuuhdDuEPhxEubtEPhEu<tEPhEutEP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	156.146.33.138	443	4788	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 04:40:13 UTC	87	OUT	GET /installer.v1.0.json HTTP/1.1 Host: static.adguard.com Connection: Keep-Alive
2024-06-22 04:40:13 UTC	629	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 04:40:13 GMT Content-Type: application/json Content-Length: 36 Connection: close Vary: Accept-Encoding Last-Modified: Tue, 29 Aug 2023 07:53:24 GMT x-rgw-object-type: Normal ETag: "77e478b081d279e52e618173a1f0f2c1" x-amz-request-id: tx000008513b3990c9b8945-00667652f1-642d55a-prg X-77-NZT: A5ySIYg3NzehJRPCMTc3N/+7AgAAWbu8pm+m+QA X-77-NZT-Ray: f6587a1dcd073c59ad557666afdfa40a X-Accel-Expires: @1719044914 X-Accel-Date: 1719030514 X-77-Cache: HIT X-77-Age: 699 Server: CDN77-Turbo Alt-Svc: h3=":443"; ma=86400 X-Cache: MISS X-77-POP: frankfurtDE Accept-Ranges: bytes
2024-06-22 04:40:13 UTC	36	IN	Data Raw: 7b 0a 09 22 79 64 78 22 3a 20 22 31 30 30 30 30 30 22 2c 0a 09 22 72 65 67 22 3a 20 22 33 32 31 22 0a 7d 0a Data Ascii: {"ydx": "100000","reg": "321"}

Target ID:	0
Start time:	00:39:35
Start date:	22/06/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe"
Imagebase:	0x10000
File size:	116'256 bytes
MD5 hash:	68B15ABF143F5DF8AAD10EAB1D2513D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:40:03
Start date:	22/06/2024
Path:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672
Imagebase:	0x680000
File size:	33'343'848 bytes
MD5 hash:	B005E4007EB93F23BB0E7F03FB634D46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	00:40:03
Start date:	22/06/2024
Path:	C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{44725021-BB47-48D3-A1BC-86BD9F03BFC7}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=704 -burn.filehandle.self=712 AID=18672
Imagebase:	0x270000
File size:	7'303'192 bytes
MD5 hash:	29467FD9BE93C4AC0BA9D863AE30EDF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3927775163.00000000077E2000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3927488066.00000000076E2000.00000002.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3925565973.00000000071A2000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000002.3927026125.00000000075A2000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.7%
Total number of Nodes:	1673
Total number of Limit Nodes:	9

Executed Functions

Function 00018170 Relevance: 91.6, APIs: 45, Strings: 7, Instructions: 599
memorywindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0001818A
strlen.MSVCRT ref: 0001819E
HeapAlloc.KERNEL32 ref: 000181B9
memchr.MSVCRT ref: 00018207
memchr.MSVCRT ref: 00018226
memchr.MSVCRT ref: 00018261
memchr.MSVCRT ref: 000182AC
HeapAlloc.KERNEL32 ref: 00018308
HeapFree.KERNEL32 ref: 000183A5
GetLastError.KERNEL32 ref: 00018403

Part of subcall function 00019B84: strlen.MSVCRT ref: 00019B91

HeapAlloc.KERNEL32 ref: 0001845C
GdiplusStartup.GDIPLUS ref: 000184AF
GetCurrentThreadId.KERNEL32 ref: 000184C0
GetDC.USER32 ref: 000184CD
GetDeviceCaps.GDI32 ref: 000184E5
ReleaseDC.USER32 ref: 000184FD
GetModuleHandleW.KERNEL32 ref: 000185BA
LoadIconW.USER32 ref: 000185DD
LoadCursorW.USER32 ref: 000185FA
RegisterClassExW.USER32(00000000), ref: 00018612
SendMessageW.USER32 ref: 00018690
SendMessageW.USER32 ref: 000186B1
SetWindowLongW.USER32(00000000,00000000), ref: 000186EF

Part of subcall function 0001B104: GlobalAlloc.KERNEL32 ref: 0001B132
Part of subcall function 0001B104: GlobalLock.KERNEL32 ref: 0001B148
Part of subcall function 0001B104: GlobalFree.KERNEL32 ref: 0001B15B

ShowWindow.USER32 ref: 000187B1

Part of subcall function 0001B2AC: GetDC.USER32 ref: 0001B2C4
Part of subcall function 0001B2AC: CreateCompatibleDC.GDI32 ref: 0001B2D1
Part of subcall function 0001B2AC: SelectObject.GDI32 ref: 0001B2F0
Part of subcall function 0001B2AC: GdipCreateFromHDC.GDIPLUS ref: 0001B351
Part of subcall function 0001B2AC: GdipCreateSolidFill.GDIPLUS ref: 0001B385
Part of subcall function 0001B2AC: GdipFillRectangleI.GDIPLUS ref: 0001B3BB
Part of subcall function 0001B2AC: GdipDeleteGraphics.GDIPLUS(?,?,?,0001B642), ref: 0001B3DA
Part of subcall function 0001B2AC: CreateCompatibleDC.GDI32(00000000), ref: 0001B3E6

Part of subcall function 0001929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,000187C3,00000000), ref: 000193A1
Part of subcall function 0001929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000193BE

GetLastError.KERNEL32(00000000,00000000), ref: 000187C9

Part of subcall function 000193D8: GetLocaleInfoW.KERNEL32 ref: 0001941D
Part of subcall function 000193D8: GetWindowLongW.USER32 ref: 0001945E
Part of subcall function 000193D8: SetWindowLongW.USER32 ref: 00019482
Part of subcall function 000193D8: ShowWindow.USER32 ref: 00019514
Part of subcall function 000193D8: SendMessageW.USER32(00000000,00000000), ref: 0001955D
Part of subcall function 000193D8: SendMessageW.USER32 ref: 00019588

CreateThread.KERNEL32(?,?,00000000,00000000), ref: 00018821
KiUserCallbackDispatcher.NTDLL(00000030), ref: 00018859
GetParent.USER32 ref: 00018890
TranslateAcceleratorW.USER32 ref: 000188DD
TranslateMessage.USER32 ref: 000188F1
DispatchMessageW.USER32 ref: 000188FB

Part of subcall function 0001B220: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 0001B242
Part of subcall function 0001B220: GdipGetImageWidth.GDIPLUS ref: 0001B265
Part of subcall function 0001B220: GdipGetImageHeight.GDIPLUS ref: 0001B28A

Part of subcall function 0001AE88: SetWindowPos.USER32 ref: 0001AEEB

Part of subcall function 0001B104: GlobalUnlock.KERNEL32 ref: 0001B177
Part of subcall function 0001B104: CreateStreamOnHGlobal.OLE32(00000000), ref: 0001B193
Part of subcall function 0001B104: GlobalFree.KERNEL32 ref: 0001B1A6

WaitForSingleObject.KERNEL32 ref: 00018929
GetExitCodeThread.KERNEL32 ref: 0001893F
CloseHandle.KERNEL32(00000000,00000000), ref: 0001894A
DeleteObject.GDI32 ref: 00018974
DeleteObject.GDI32(00000001), ref: 00018985
GdiplusShutdown.GDIPLUS(00000000), ref: 00018996
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 000189AC
UnregisterClassW.USER32 ref: 000189BE
HeapFree.KERNEL32(00000000), ref: 000189E9
HeapFree.KERNEL32 ref: 00018A2A
HeapFree.KERNEL32 ref: 00018A46
HeapFree.KERNEL32 ref: 00018A62
HeapFree.KERNEL32 ref: 00018A7E
HeapFree.KERNEL32 ref: 00018AB6

Strings

0, xrefs: 000185AC
setup_args, xrefs: 00018328
http_url, xrefs: 00018352
X, xrefs: 000184DA
https_url, xrefs: 00018376
AdGuard VPN Web Installer, xrefs: 00018645
ADGUARD_WI_WNDCLASS, xrefs: 000185CB, 000189B7

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$CreateGdip$GlobalMessageWindow$AllocObjectSendmemchr$DeleteHandleLongThread$ClassCompatibleErrorFillFromGdiplusImageLastLoadModuleShowTranslatestrlen$AcceleratorBitmapCallbackCapsCloseCodeCurrentCursorDeviceDispatchDispatcherExitGraphicsHeightIconInfoLocaleLockParentProcessRectangleRegisterReleaseSelectShutdownSingleSolidStartupStreamUnlockUnregisterUserWaitWidth
String ID: 0$ADGUARD_WI_WNDCLASS$AdGuard VPN Web Installer$X$http_url$https_url$setup_args
API String ID: 4084662147-2100270031
Opcode ID: 4f5d6a7b831b7e7f6c468bd1b7a1222495223a14aaf56c5288f73ae635396582
Instruction ID: 312530948c55751fc340c95bc735f7462996d61bd76a5170738983cd9f36e6b9
Opcode Fuzzy Hash: 4f5d6a7b831b7e7f6c468bd1b7a1222495223a14aaf56c5288f73ae635396582
Instruction Fuzzy Hash: AB4217B09047059FE750EFA8D98879EBBF4BF48304F10C52DE8899B355DB789985CB82

Function 00018E34 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 218
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00019F00: DeleteFileW.KERNEL32 ref: 00019F3A
Part of subcall function 00019F00: HeapFree.KERNEL32 ref: 00019F59

Part of subcall function 00019DB8: CreateFileW.KERNEL32 ref: 00019EB6
Part of subcall function 00019DB8: HeapFree.KERNEL32 ref: 00019EE5

GetLastError.KERNEL32 ref: 00018E5C
InternetOpenW.WININET ref: 00018F1E
InternetOpenUrlW.WININET ref: 00018F76
InternetReadFile.WININET ref: 0001904D
WriteFile.KERNEL32 ref: 00019084
RtlFreeHeap.NTDLL ref: 000190D9
InternetCloseHandle.WININET ref: 000190EB
InternetCloseHandle.WININET ref: 000190F1
GetLastError.KERNEL32 ref: 00019103

Part of subcall function 00018CD8: RtlAllocateHeap.NTDLL ref: 00018D1C

CloseHandle.KERNEL32 ref: 00019130

Strings

AdGuard VPN Web Installer, xrefs: 00018F17
https://, xrefs: 00018F34

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Internet$FileHeap$CloseFreeHandle$ErrorLastOpen$AllocateCreateDeleteReadWrite
String ID: AdGuard VPN Web Installer$https://
API String ID: 4088500118-2703855203
Opcode ID: 4acdbc688e0fe1d47b0d7d5212bbdb337444923f173b50b809a7cbd6df7e2e61
Instruction ID: a4bc1091f293f3640a9337d91b88660621c369fdd45e273180ddf9ba751831a4
Opcode Fuzzy Hash: 4acdbc688e0fe1d47b0d7d5212bbdb337444923f173b50b809a7cbd6df7e2e61
Instruction Fuzzy Hash: A6914970A043059FEB10EFA8D9987DEBBF5BF88310F108629E454A7290DB74D985CF92

Function 0001117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000111C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00011248
__p__acmdln.MSVCRT ref: 00011271
malloc.MSVCRT ref: 000112FB
strlen.MSVCRT ref: 0001132B
malloc.MSVCRT ref: 00011336
memcpy.MSVCRT ref: 0001134C
GetStartupInfoA.KERNEL32 ref: 00011443

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 05cfcf7d9ed9850f2e07f00728a6b30908429cb3dacdf7912e81783a19ceb39a
Instruction ID: b94864f6c6856edd480015fb3279bb2778daddef4702b9dad5cc6246eb8b4e27
Opcode Fuzzy Hash: 05cfcf7d9ed9850f2e07f00728a6b30908429cb3dacdf7912e81783a19ceb39a
Instruction Fuzzy Hash: 0D819C719082448FEB68DFA4E9C47EDB7F1FB54300F204429EA4897351D7B998C6CB92

Function 000113D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00011248
__p__acmdln.MSVCRT ref: 00011271
malloc.MSVCRT ref: 000112FB
strlen.MSVCRT ref: 0001132B
malloc.MSVCRT ref: 00011336
memcpy.MSVCRT ref: 0001134C
_amsg_exit.MSVCRT ref: 000113F2
_initterm.MSVCRT ref: 00011414

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 764167f8fb34f8b09eed5fdfc07219a1631975ddc8f1205dc8b240aa9e4cf1dd
Instruction ID: c28cea3a245293cc0ad7a778f34dcbcc0a31b73f77f6fdac6d84fe6b3b672e07
Opcode Fuzzy Hash: 764167f8fb34f8b09eed5fdfc07219a1631975ddc8f1205dc8b240aa9e4cf1dd
Instruction Fuzzy Hash: 7C410BB49083458FEB64EFA4E9C57DDB7F1BB58300F20442DEA4897211D7B898C6CB52

Function 000111B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000111C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00011248
__p__acmdln.MSVCRT ref: 00011271
malloc.MSVCRT ref: 000112FB
strlen.MSVCRT ref: 0001132B
malloc.MSVCRT ref: 00011336
memcpy.MSVCRT ref: 0001134C
_amsg_exit.MSVCRT ref: 000113F2
_initterm.MSVCRT ref: 00011414

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 8f2672513a4988be44b5b10e083d2844e4a6ac92cad5831a3deb212ee9f28729
Instruction ID: e4d8895567255fb3ffdc8775780bce9e7aab705d995e759d4a0c0116cab35486
Opcode Fuzzy Hash: 8f2672513a4988be44b5b10e083d2844e4a6ac92cad5831a3deb212ee9f28729
Instruction Fuzzy Hash: F8411A70A083458FEB64DF68E9C47D9B7F0BB18340F20452DEA4887215D7B898C6CB91

Function 00011170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000111C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00011248
__p__acmdln.MSVCRT ref: 00011271
malloc.MSVCRT ref: 000112FB
strlen.MSVCRT ref: 0001132B
malloc.MSVCRT ref: 00011336
memcpy.MSVCRT ref: 0001134C
GetStartupInfoA.KERNEL32 ref: 00011443

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 68c26ecdca0c7f7fc11de8e9a1e2d91e74361a34fff35ba1fad8bc76cd14fae6
Instruction ID: f2a91879476618336b89a77b713d08c39578f99fb8ae71abd1cad2355e2bebc1
Opcode Fuzzy Hash: 68c26ecdca0c7f7fc11de8e9a1e2d91e74361a34fff35ba1fad8bc76cd14fae6
Instruction Fuzzy Hash: C7515A71A083459FEB24DFA8E9C47DAB7F0FB58740F20452DEA4897315D7B89882CB91

Function 00019998 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,00000000,00000001,?,?,000183D3), ref: 000199AC
FindResourceW.KERNEL32 ref: 000199C4
SizeofResource.KERNEL32(?,?,?,?,?,00000000,00000001,?,?,000183D3), ref: 000199DF
LoadResource.KERNEL32(?,?,?,?,?,?,?,00000000,00000001,?,?,000183D3), ref: 000199F4
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,000183D3), ref: 000199FF

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModuleSizeof
String ID:
API String ID: 1601749889-0
Opcode ID: 231d101cbd284f7ab07f1a636b14da792ab238c371b140cb671f407b40c4970a
Instruction ID: 1dce161e4f0ae8f20238ac6c0d16168894238d356648d08d378279a505a7e36f
Opcode Fuzzy Hash: 231d101cbd284f7ab07f1a636b14da792ab238c371b140cb671f407b40c4970a
Instruction Fuzzy Hash: 960144B2508701AFD7106FB89D4866ABBF8FF84751F11862EF499C3250E77488418B52

Function 0001B6A8 Relevance: 44.4, APIs: 24, Strings: 1, Instructions: 694windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0001B772
FillRect.USER32(?,?), ref: 0001B78B
GetFocus.USER32 ref: 0001BBC7
GetClientRect.USER32 ref: 0001BC26
SetWindowPos.USER32 ref: 0001BD33
PostQuitMessage.USER32 ref: 0001BFF6
SetWindowLongW.USER32 ref: 0001C01B

Strings

N, xrefs: 0001B751

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientWindow$FillFocusLongMessagePostQuit
String ID: N
API String ID: 3298376866-1130791706
Opcode ID: 3c4a96f40b8a35aecde9866a5880d5c590def4c795ecbaa9595a6dee2eb2fe43
Instruction ID: 0e649a0ff4242c12ee65c2efabf935802a0f8f631925a4e386f616133b027a4f
Opcode Fuzzy Hash: 3c4a96f40b8a35aecde9866a5880d5c590def4c795ecbaa9595a6dee2eb2fe43
Instruction Fuzzy Hash: BC521470A05305DFDB64DFA8C988AAEBBF0BF48354F14892DE8999B254D734D885CF42

Function 0001B2AC Relevance: 16.7, APIs: 11, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 0001B2C4
CreateCompatibleDC.GDI32 ref: 0001B2D1
SelectObject.GDI32 ref: 0001B2F0
GdipCreateFromHDC.GDIPLUS ref: 0001B351
GdipCreateSolidFill.GDIPLUS ref: 0001B385
GdipFillRectangleI.GDIPLUS ref: 0001B3BB
GdipDeleteGraphics.GDIPLUS(?,?,?,0001B642), ref: 0001B3DA
CreateCompatibleDC.GDI32(00000000), ref: 0001B3E6
AlphaBlend.MSIMG32 ref: 0001B460
UpdateLayeredWindow.USER32 ref: 0001B514
ReleaseDC.USER32(00000000), ref: 0001B54B

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: CreateGdip$CompatibleFill$AlphaBlendDeleteFromGraphicsLayeredObjectRectangleReleaseSelectSolidUpdateWindow
String ID:
API String ID: 545367414-0
Opcode ID: 08e54033c6c4bbb1e857903f98e72bff9dfe07762a3353acb9d1cb1053c7b2d9
Instruction ID: 82e0e4244e94b5cb7e5627dffc35b488de98d686412285fa96a968aeb8640899
Opcode Fuzzy Hash: 08e54033c6c4bbb1e857903f98e72bff9dfe07762a3353acb9d1cb1053c7b2d9
Instruction Fuzzy Hash: B5919EB49053189FDB40DFA8D984A9EBBF4FB88310F10892EE899E7310E774A9458F51

Function 00019144 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0001929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,000187C3,00000000), ref: 000193A1
Part of subcall function 0001929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000193BE

Part of subcall function 0001ABB8: strlen.MSVCRT ref: 0001ABD2
Part of subcall function 0001ABB8: HeapAlloc.KERNEL32 ref: 0001AC34
Part of subcall function 0001ABB8: MultiByteToWideChar.KERNEL32 ref: 0001AC68
Part of subcall function 0001ABB8: HeapFree.KERNEL32 ref: 0001AC8B

CreateProcessW.KERNEL32 ref: 00019204
CloseHandle.KERNEL32 ref: 0001921A
HeapFree.KERNEL32 ref: 00019241
HeapFree.KERNEL32 ref: 0001925D
CloseHandle.KERNEL32 ref: 0001926F
HeapFree.KERNEL32 ref: 0001928A

Strings

%s %s%Z, xrefs: 00019165
D, xrefs: 000191BB

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$CloseHandle$AllocByteCharCreateMultiProcessWidestrlen
String ID: %s %s%Z$D
API String ID: 2791976147-1551950450
Opcode ID: de48aa61c0900686e64ac705e94ae8ac20ea45979f95a05c5482f444a938478e
Instruction ID: 1fb7da07825face455b31c1b912236ff9b8af049e937110a48a79c6328615f1d
Opcode Fuzzy Hash: de48aa61c0900686e64ac705e94ae8ac20ea45979f95a05c5482f444a938478e
Instruction Fuzzy Hash: 93312EB09047059FE710EFB9D89439EBBF5AF88310F108A2DE5A497290D77894898B82

Function 0001B104 Relevance: 13.6, APIs: 9, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00019998: GetModuleHandleW.KERNEL32(?,?,00000000,00000001,?,?,000183D3), ref: 000199AC
Part of subcall function 00019998: FindResourceW.KERNEL32 ref: 000199C4

GlobalAlloc.KERNEL32 ref: 0001B132
GlobalLock.KERNEL32 ref: 0001B148
GlobalFree.KERNEL32 ref: 0001B15B
GlobalUnlock.KERNEL32 ref: 0001B177
CreateStreamOnHGlobal.OLE32(00000000), ref: 0001B193
GlobalFree.KERNEL32 ref: 0001B1A6

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Global$Free$AllocCreateFindHandleLockModuleResourceStreamUnlock
String ID:
API String ID: 785323675-0
Opcode ID: 8201b52059f6c2a46500589b94e53bdf61797aa86bae93794f0c28712d034e1c
Instruction ID: 795b27e26cd3aa113e80be5b80688e36130904a5ae56d19d8caa475e809ae164
Opcode Fuzzy Hash: 8201b52059f6c2a46500589b94e53bdf61797aa86bae93794f0c28712d034e1c
Instruction Fuzzy Hash: 623106B59042049FDB14EFA8C988ADEBBF8FF8C310F158569E948E7201E7749884CF61

Function 0001B55C Relevance: 7.5, APIs: 5, Instructions: 43
synchronizationthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 0001B579
GetExitCodeThread.KERNEL32 ref: 0001B58F
CloseHandle.KERNEL32(00000000,00000000), ref: 0001B59A

Part of subcall function 00019144: HeapFree.KERNEL32 ref: 00019241
Part of subcall function 00019144: HeapFree.KERNEL32 ref: 0001925D
Part of subcall function 00019144: CloseHandle.KERNEL32 ref: 0001926F
Part of subcall function 00019144: HeapFree.KERNEL32 ref: 0001928A

GetLastError.KERNEL32 ref: 0001B5BF
SendMessageW.USER32 ref: 0001B5EE

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap$CloseHandle$CodeErrorExitLastMessageObjectSendSingleThreadWait
String ID:
API String ID: 426020348-0
Opcode ID: 1b908aa56ff0015172867414e416dd53abb6605ad87f639996121645db37c512
Instruction ID: 206feddec7fca7a4aff8ac2f3ededb8c6e84d8bdedc3d6c79f8a40183ec74579
Opcode Fuzzy Hash: 1b908aa56ff0015172867414e416dd53abb6605ad87f639996121645db37c512
Instruction Fuzzy Hash: 46111BB0504705AFE710AFA5D89CB9EBBF8EF08304F40846DE58587261D7789884CF52

Function 00019BD4 Relevance: 6.1, APIs: 4, Instructions: 94
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0001ABB8: strlen.MSVCRT ref: 0001ABD2
Part of subcall function 0001ABB8: HeapAlloc.KERNEL32 ref: 0001AC34
Part of subcall function 0001ABB8: MultiByteToWideChar.KERNEL32 ref: 0001AC68
Part of subcall function 0001ABB8: HeapFree.KERNEL32 ref: 0001AC8B

strlen.MSVCRT ref: 00019C26
CreateDirectoryW.KERNEL32 ref: 00019CA3
GetLastError.KERNEL32 ref: 00019CBC
HeapFree.KERNEL32 ref: 00019CEC

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Freestrlen$AllocByteCharCreateDirectoryErrorLastMultiWide
String ID:
API String ID: 896362570-0
Opcode ID: d2b16f1cb17166db11044cbe2940f03d6acf71120f52376cf4baf4ef7fb3ed44
Instruction ID: 8e3a6db740fb9d3d3ef1ff2d49b7ea60e152408ac14fe095554cc961430b1524
Opcode Fuzzy Hash: d2b16f1cb17166db11044cbe2940f03d6acf71120f52376cf4baf4ef7fb3ed44
Instruction Fuzzy Hash: 183103715043198EDB70ABB8C8E83EABBEAEB15350F448169D5D4C7290E3754DC5CBC2

Function 000112A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 000112FB
strlen.MSVCRT ref: 0001132B
malloc.MSVCRT ref: 00011336
memcpy.MSVCRT ref: 0001134C

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 86dcc2683dfd1de315188be16bb028d1b61382b577158f355c626657922e02ed
Instruction ID: e72416f73c053532a595cba447c23f21f45ec496c3ef01e00f5ab7057e635486
Opcode Fuzzy Hash: 86dcc2683dfd1de315188be16bb028d1b61382b577158f355c626657922e02ed
Instruction Fuzzy Hash: E6317675A083458FEB24DF68E8C47D9BBF1FB08300F208529DA4897312D778A986CF81

Function 000113C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 000112FB
strlen.MSVCRT ref: 0001132B
malloc.MSVCRT ref: 00011336
memcpy.MSVCRT ref: 0001134C

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: a6668b99f82c91f9462775b3bf4b240247583bc00ddd924af16a3b04f1fb7d82
Instruction ID: d146d86936e418a19d9b5f98f30478ad7db5f6dd4fbdf9ed06b46c821823bafc
Opcode Fuzzy Hash: a6668b99f82c91f9462775b3bf4b240247583bc00ddd924af16a3b04f1fb7d82
Instruction Fuzzy Hash: F821F5B5A08345CFDB25DF68E8846D9B7F1FB58300F20852ADA4897315E778A982CF81

Function 0001B220 Relevance: 4.6, APIs: 3, Instructions: 50
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 0001B242
GdipGetImageWidth.GDIPLUS ref: 0001B265
GdipGetImageHeight.GDIPLUS ref: 0001B28A

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Gdip$Image$BitmapCreateFromHeightWidth
String ID:
API String ID: 827228198-0
Opcode ID: d5384ace18526dfa02fc9ed9e983848a8f41f5692bbe84d4d7d6a49b42c56bb1
Instruction ID: 7d163b8b885cf907cc50138291a99733967913e3e6e982cc8fd67ba75a2c50fd
Opcode Fuzzy Hash: d5384ace18526dfa02fc9ed9e983848a8f41f5692bbe84d4d7d6a49b42c56bb1
Instruction Fuzzy Hash: FE11C5B0D046069FDB10DFA9C4856AEFBF8EB88340F04C42AE858DB205E774D9458BA1

Function 00019DB8 Relevance: 3.1, APIs: 2, Instructions: 88filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0001ABB8: strlen.MSVCRT ref: 0001ABD2
Part of subcall function 0001ABB8: HeapAlloc.KERNEL32 ref: 0001AC34
Part of subcall function 0001ABB8: MultiByteToWideChar.KERNEL32 ref: 0001AC68
Part of subcall function 0001ABB8: HeapFree.KERNEL32 ref: 0001AC8B

CreateFileW.KERNEL32 ref: 00019EB6
HeapFree.KERNEL32 ref: 00019EE5

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharCreateFileMultiWidestrlen
String ID:
API String ID: 4054799010-0
Opcode ID: d88bf5bd0861449c1b51837850b9d8cb5eebfcaa85cd17bfce3e33bc03ed62a8
Instruction ID: c382b1b65d1b8ca70ba8b7f1322894860911f9d2188a9216a4aae9b0466b8f77
Opcode Fuzzy Hash: d88bf5bd0861449c1b51837850b9d8cb5eebfcaa85cd17bfce3e33bc03ed62a8
Instruction Fuzzy Hash: 0F31E471E042048BDB20DF69D8983DEBBF5EB84310F2486AAE458D7294D7749EC5CF81

Function 00018CD8 Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00018D1C
HeapReAlloc.KERNEL32 ref: 00018D3D

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocAllocate
String ID:
API String ID: 2177240990-0
Opcode ID: 02d152d8224b72ac6a710e68675ccb274384823b6c53c350bd94da4518dc5d2d
Instruction ID: 0f8479983aab9329c614538c6a99c6c997b83303837a00b0c96fd0258be9850a
Opcode Fuzzy Hash: 02d152d8224b72ac6a710e68675ccb274384823b6c53c350bd94da4518dc5d2d
Instruction Fuzzy Hash: 43111C75A01705DFDB28DF6AE48476ABBF1FF98300F14C06DD8498B258EB349984CB52

Function 00019A14 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,0001D008,?,?,0001B07B), ref: 00019A31
CreateWindowExW.USER32 ref: 00019AAF

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: CreateHandleModuleWindow
String ID:
API String ID: 1178124398-0
Opcode ID: 6bea3f2e72e9d06e1b73f62a9344fe12df3538b675f09605a776ed1cb4820e00
Instruction ID: 12e2a7642a71ce378e95ebdb4906c87f6028d3e1ec601e8abc85b97251c7777f
Opcode Fuzzy Hash: 6bea3f2e72e9d06e1b73f62a9344fe12df3538b675f09605a776ed1cb4820e00
Instruction Fuzzy Hash: BE1136B1A19311AFD704CF69D98064AFBE8FB8C320F10892EF898C7350D374E9508B92

Function 0001AEFC Relevance: 3.0, APIs: 2, Instructions: 40memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0001ABB8: strlen.MSVCRT ref: 0001ABD2
Part of subcall function 0001ABB8: HeapAlloc.KERNEL32 ref: 0001AC34
Part of subcall function 0001ABB8: MultiByteToWideChar.KERNEL32 ref: 0001AC68
Part of subcall function 0001ABB8: HeapFree.KERNEL32 ref: 0001AC8B

SendMessageW.USER32 ref: 0001AF57
HeapFree.KERNEL32 ref: 0001AF78

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharMessageMultiSendWidestrlen
String ID:
API String ID: 2843101947-0
Opcode ID: 36697c988fcff1a80f9471444258a3c8fd5d2980d19341ee6b853d23775c9ac3
Instruction ID: 58eaf12334b920f6f0c522c7c86f91b1f401898871ef3035bcda5b5672106d0b
Opcode Fuzzy Hash: 36697c988fcff1a80f9471444258a3c8fd5d2980d19341ee6b853d23775c9ac3
Instruction Fuzzy Hash: 110171B5A053049FD720AFADE88879DBBF4EB84300F10856DE88887350D7759985CF92

Function 00019F00 Relevance: 3.0, APIs: 2, Instructions: 31filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0001ABB8: strlen.MSVCRT ref: 0001ABD2
Part of subcall function 0001ABB8: HeapAlloc.KERNEL32 ref: 0001AC34
Part of subcall function 0001ABB8: MultiByteToWideChar.KERNEL32 ref: 0001AC68
Part of subcall function 0001ABB8: HeapFree.KERNEL32 ref: 0001AC8B

DeleteFileW.KERNEL32 ref: 00019F3A
HeapFree.KERNEL32 ref: 00019F59

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharDeleteFileMultiWidestrlen
String ID:
API String ID: 3068648626-0
Opcode ID: 5d3de52e7f07c445d00f724539b571c6ce23627c1351faf2e8f2395a851f60c0
Instruction ID: 684ac40820535f9130a392540eba9d92933c042984dbc2681491f335573e16b2
Opcode Fuzzy Hash: 5d3de52e7f07c445d00f724539b571c6ce23627c1351faf2e8f2395a851f60c0
Instruction Fuzzy Hash: 8BF030B1505314ABDB10AFA8E88C6DABBF8EB04710F108659E598C7291D77459858F92

Function 0001ADDC Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00018668), ref: 0001AE00
LoadImageW.USER32 ref: 0001AE2A

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: HandleImageLoadModule
String ID:
API String ID: 2603579926-0
Opcode ID: eaceee54129873891734172eb5100aac4d5707862290518b22c7d1f8fd36de07
Instruction ID: 3ba28a9ce152909033710db4a41aee48612a9520a99e2c6f191f98cb61518923
Opcode Fuzzy Hash: eaceee54129873891734172eb5100aac4d5707862290518b22c7d1f8fd36de07
Instruction Fuzzy Hash: ECF082B09043009BE700AFA9E94839AFBF4FB88354F00892EE9D883340D7B994558B92

Function 000198B4 Relevance: 1.6, APIs: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 0001992A

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b502e5f4d20859bb5d106961cdb23db04da92e52abacfeabfcb127715789c39a
Instruction ID: cadb43a3e013771ac860ffaf1034ce0f3dc34956bfef34c1986acf1676f3b05a
Opcode Fuzzy Hash: b502e5f4d20859bb5d106961cdb23db04da92e52abacfeabfcb127715789c39a
Instruction Fuzzy Hash: A9214971A04304DFDB10DF69D4846DEBBF4FB89324F10862EE9689B290D7799845CF92

Function 0001B020 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32 ref: 0001B04F

Part of subcall function 00019A14: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,0001D008,?,?,0001B07B), ref: 00019A31
Part of subcall function 00019A14: CreateWindowExW.USER32 ref: 00019AAF

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Create$BrushHandleModuleSolidWindow
String ID:
API String ID: 1662306801-0
Opcode ID: e99b2b1ebbfedffbc433875cf2377922f297d94802f9bba85e5dc8b86d749a8d
Instruction ID: 8c9ad536624a44ab79f55cf9a04f263aa6819a13a60dc546711d5194fa0b0448
Opcode Fuzzy Hash: e99b2b1ebbfedffbc433875cf2377922f297d94802f9bba85e5dc8b86d749a8d
Instruction Fuzzy Hash: BEF0E9B15003049BDB00DFAAD8447DABFF4FF88720F41803DE9489B292D3B99588CB61

Function 00018C90 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00018CB6

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7c13a6de75c804612240f829cf6c9fe82527ae87115b9c2940a1a5e96291716e
Instruction ID: 03722ab6c59e142cc447f0b830bf978b37d31113f8b4ecab4fce9c8e87387aa4
Opcode Fuzzy Hash: 7c13a6de75c804612240f829cf6c9fe82527ae87115b9c2940a1a5e96291716e
Instruction Fuzzy Hash: 7EE07DB0504304DFD710EF68D689746BBF4AB44348F15C458D8488B355D379D944CB91

Function 00019B84 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00019B91

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 1b6b4a49818362832c93dce2a13d75510bb9af8dc27697fe666a996c876aae41
Instruction ID: 4e0e4a8af06d4dca8d92eadf337ab1331845e3d1236956773a9b27ceec941e70
Opcode Fuzzy Hash: 1b6b4a49818362832c93dce2a13d75510bb9af8dc27697fe666a996c876aae41
Instruction Fuzzy Hash: 55F0EC1161C2F85FCF7532B825E11FEBBD84B1E200F4409F5D596CB346E29588C443D2

Non-executed Functions

Function 000193D8 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 268windowstringCOMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0001941D

Part of subcall function 0001B020: CreateSolidBrush.GDI32 ref: 0001B04F

GetWindowLongW.USER32 ref: 0001945E
SetWindowLongW.USER32 ref: 00019482

Part of subcall function 0001AEFC: SendMessageW.USER32 ref: 0001AF57
Part of subcall function 0001AEFC: HeapFree.KERNEL32 ref: 0001AF78

Part of subcall function 0001AE88: SetWindowPos.USER32 ref: 0001AEEB

ShowWindow.USER32 ref: 00019514

Part of subcall function 0001ADDC: GetModuleHandleW.KERNEL32(?,?,?,00018668), ref: 0001AE00
Part of subcall function 0001ADDC: LoadImageW.USER32 ref: 0001AE2A

SendMessageW.USER32(00000000,00000000), ref: 0001955D
SendMessageW.USER32 ref: 00019588

Part of subcall function 0001AD58: MultiByteToWideChar.KERNEL32 ref: 0001ADA4

CreateFontIndirectW.GDI32 ref: 000195AA
CreateSolidBrush.GDI32(?), ref: 000195C5
LoadImageW.USER32 ref: 00019671
SendMessageW.USER32 ref: 0001969C
ShowWindow.USER32 ref: 000196C1
strlen.MSVCRT ref: 000196DA
ShowWindow.USER32(00000000,00000000), ref: 00019732
LoadCursorW.USER32(00000000,00000000), ref: 00019757
SetWindowLongW.USER32 ref: 0001978D
CreateFontIndirectW.GDI32 ref: 00019816
SendMessageW.USER32 ref: 0001984B
strlen.MSVCRT ref: 00019874
ShowWindow.USER32 ref: 000198A6

Strings

An error has occurred during the installation.Please try downloading the installer manually., xrefs: 000193E4
Download AdGuard VPN, xrefs: 00019851
0, xrefs: 00019836
AdGuard VPN Web Installer, xrefs: 00019499

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Window$MessageSend$CreateShow$LoadLong$BrushFontImageIndirectSolidstrlen$ByteCharCursorFreeHandleHeapInfoLocaleModuleMultiWide
String ID: 0$AdGuard VPN Web Installer$An error has occurred during the installation.Please try downloading the installer manually.$Download AdGuard VPN
API String ID: 3353892530-2983585088
Opcode ID: fbfb4af7c8793284e0e33e08031982fc7cf36d40725d83444c0da1688cd6f825
Instruction ID: 6dcc62a6419c5fbc3830275225700c1648974b3236a95e914cadd28d529f8daf
Opcode Fuzzy Hash: fbfb4af7c8793284e0e33e08031982fc7cf36d40725d83444c0da1688cd6f825
Instruction Fuzzy Hash: F7D128705043159FE710EF68C8447DABBF0FF88314F508969E9899B362D778A985CF92

Function 000114F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00011500
LoadLibraryA.KERNEL32 ref: 00011516
GetProcAddress.KERNEL32 ref: 00011535
GetProcAddress.KERNEL32 ref: 00011547

Strings

libgcc_s_dw2-1.dll, xrefs: 000114F9, 0001150F
__register_frame_info, xrefs: 0001152A
__deregister_frame_info, xrefs: 0001153C

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 69e5f8d74fa7165337da9ce2107eda279bc5767df4100f1f2a91ac987f6b3821
Instruction ID: ff2cdb99ffa5685212706337a458f530748798b8d6bbfc73874b154de29b36c2
Opcode Fuzzy Hash: 69e5f8d74fa7165337da9ce2107eda279bc5767df4100f1f2a91ac987f6b3821
Instruction Fuzzy Hash: 81015EB1805240DBD710BFB9EA483DDBFE4EB44350F41442DEA8547200D7B894C8CB92

Function 00015010 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1481COMMON

Download Yara Rule

Strings

NaN, xrefs: 000150DF
, xrefs: 000164EE
, xrefs: 00016786
Infinity, xrefs: 00015340
9, xrefs: 000165AB

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $9$Infinity$NaN
API String ID: 0-2156819404
Opcode ID: a3ae716d57d5239b4da9e2ad280fe5b0d345ccf0f8dead7725f909d5cd2d3470
Instruction ID: 29631132cb1956d30cd2da81a0949055a8b2a8d4ccb63eee26551ff7a74b2a88
Opcode Fuzzy Hash: a3ae716d57d5239b4da9e2ad280fe5b0d345ccf0f8dead7725f909d5cd2d3470
Instruction Fuzzy Hash: 74D214B1A08781CFD761DF29C88479AFBE1BBC4354F14891DE8998B351E776D8848F82

Function 00013D60 Relevance: 7.9, Strings: 6, Instructions: 417COMMON

Download Yara Rule

Strings

., xrefs: 00013DFD
@, xrefs: 00013ECC
Inf, xrefs: 000142AC
gfff, xrefs: 00013E70
NaN, xrefs: 000140C2
gfff, xrefs: 00013E35

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: 22fbe597aa4af8dde4816973a72f61294b961d6f6baad1eabb289b79e998d03f
Instruction ID: c0b1705395ab4e90b0e424317e8331699fa853131c2fa2d43be36d96a74881ab
Opcode Fuzzy Hash: 22fbe597aa4af8dde4816973a72f61294b961d6f6baad1eabb289b79e998d03f
Instruction Fuzzy Hash: F8E10271A083018BD7649E29C4843ABF7E1EFC8304F188A2DF999DB395D671DD85CB82

Function 000118C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 000118EF
vfprintf.MSVCRT ref: 0001190F
abort.MSVCRT ref: 00011914
VirtualQuery.KERNEL32 ref: 000119AB

Strings

Mingw-w64 runtime failure:, xrefs: 000118E8
VirtualQuery failed for %d bytes at address %p, xrefs: 00011A57
VirtualProtect failed with code 0x%x, xrefs: 00011A26
Address %p has no image-section, xrefs: 00011A6B

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: 06b35d9b9774ee5f90dd90799f54071794820be09edaae64876abb4e1d4b26bc
Instruction ID: ee0a6b72f2704037b91a3c0f1f907b13ee9aa338ed50f5a9e7ed7f91d4fc2a70
Opcode Fuzzy Hash: 06b35d9b9774ee5f90dd90799f54071794820be09edaae64876abb4e1d4b26bc
Instruction Fuzzy Hash: 4B519DB19043018FD714EF68D8856DAFBF0FF84354F54892DE5988B251E778E886CB92

Function 00011D50 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00011D8F
signal.MSVCRT ref: 00011DD6
signal.MSVCRT ref: 00011DEF
signal.MSVCRT ref: 00011E16
signal.MSVCRT ref: 00011E5A

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 74782142597ac9685deefccef5dba302a64587439a5aa88118bd85f41f224140
Instruction ID: 4ff2b9befed8f8b4b75829cb7809a85376ac5facb143e933ce03c4088bb00732
Opcode Fuzzy Hash: 74782142597ac9685deefccef5dba302a64587439a5aa88118bd85f41f224140
Instruction Fuzzy Hash: A9312DB050C6018AE7A86FA8D5443EE76E0AF45368F114B09EAE8C73D2CB79C8C4D753

Function 00012AB0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 395COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00012C60
memset.MSVCRT ref: 00012D7F

Strings

0, xrefs: 00012FA7
o, xrefs: 00012FC8

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: fputcmemset
String ID: 0$o
API String ID: 947785774-4157579757
Opcode ID: 8e0685638adb49ae4f37e01c505298bd78bdcd604d7e6113846537aeeb44b7b6
Instruction ID: 245513492247cd8333dc13ecca129bc3da1f8698b94e530d1d943a648414a697
Opcode Fuzzy Hash: 8e0685638adb49ae4f37e01c505298bd78bdcd604d7e6113846537aeeb44b7b6
Instruction Fuzzy Hash: 42F14F72E042188FDB14DF68D4942DDBBF2BF84314F198269E959EB385D734E892CB90

Function 00017E61 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00017E6C
GetProcAddress.KERNEL32 ref: 00017E8C
GetProcAddress.KERNEL32 ref: 00017ECB

Strings

msvcrt.dll, xrefs: 00017E65
___lc_codepage_func, xrefs: 00017E84
__lc_codepage, xrefs: 00017EC0

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: ff044395c1e7b9bad6d7f20bb4a11f63c7baf19825b1672ca68d360f75c0778b
Instruction ID: d9f8ed67d33f7a46fcf935ccb515f9f3621137f972f3fdc23a12e80548515656
Opcode Fuzzy Hash: ff044395c1e7b9bad6d7f20bb4a11f63c7baf19825b1672ca68d360f75c0778b
Instruction Fuzzy Hash: 9FF062B19492008BD710BF78AE452897FF0BB0C310F55497AC889C7241E678D885C793

Function 00013050 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

0, xrefs: 000133FA

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 906d0336041f0955854ea0fe103f6f14ae2e15edb6cc9c825826e81eb6b08927
Instruction ID: 13ae8d5a1ca4d267cfdd97dd4d23c6cc5b0d66b6b67b8cddab8fbb99022bb5e4
Opcode Fuzzy Hash: 906d0336041f0955854ea0fe103f6f14ae2e15edb6cc9c825826e81eb6b08927
Instruction Fuzzy Hash: C3B17871A042159BDB15DF68C4847DEBBF1AF88304F298169EC59AF386D774EE81CB80

Function 00013183 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000131BD
fputc.MSVCRT ref: 00013277
fputc.MSVCRT ref: 000132D1

Strings

0, xrefs: 000131AE

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: fputc$memset
String ID: 0
API String ID: 2944404495-4108050209
Opcode ID: 0ae888e68ee06ac94637e7e2c572a203338626a9d5973659b47df7a582a49451
Instruction ID: 1fcf9866e2bc02e006b435605bb47561dcc6e19c1a9531cd40cfbca86c234598
Opcode Fuzzy Hash: 0ae888e68ee06ac94637e7e2c572a203338626a9d5973659b47df7a582a49451
Instruction Fuzzy Hash: 96314871E052118BDB54DF68C1847DABBF2BF88740F258169ED48AB34AD734EE81CB84

Function 000133CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00013277
fputc.MSVCRT ref: 000132D1
memset.MSVCRT ref: 00013405

Strings

0, xrefs: 000133FA

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: fputc$memset
String ID: 0
API String ID: 2944404495-4108050209
Opcode ID: cf32a4d500d49d76f558de93517f77d76bc5c35e592a36b3ebc26798908fe853
Instruction ID: a93454d37357680213eaccdc81cc54ccbde84f576dc03447b2f69aa575b82a67
Opcode Fuzzy Hash: cf32a4d500d49d76f558de93517f77d76bc5c35e592a36b3ebc26798908fe853
Instruction Fuzzy Hash: 2F2130B19082018BDB54EF68C0C47D9BBF1BF84350F258659D8999F386D335EE81CB84

Function 00017E18 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00017E32
strchr.MSVCRT ref: 00017E42
atoi.MSVCRT ref: 00017E53

Strings

., xrefs: 00017E37

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction ID: 7c90590ebbad067110c30a14f7c87bf8d0d7df243f0d7ae4453b32bb0d3b6cad
Opcode Fuzzy Hash: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction Fuzzy Hash: CBE0ECB19087004AD7007F38C50A39ABAF2AB84304F4988ACE48C87747E77998859752

Function 0001ABB8 Relevance: 6.3, APIs: 5, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0001ABD2
MultiByteToWideChar.KERNEL32 ref: 0001AC02
HeapAlloc.KERNEL32 ref: 0001AC34
MultiByteToWideChar.KERNEL32 ref: 0001AC68
HeapFree.KERNEL32 ref: 0001AC8B

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharHeapMultiWide$AllocFreestrlen
String ID:
API String ID: 998811608-0
Opcode ID: 265b1d2e13625c6257664dce66bdc64bc7f8940d1b8cbdcde60e1c1d8f3e6b2c
Instruction ID: 63b09d1f5193d0e3d1b8bb71e5a6c2be11b5242179f87caec528e80d1b5eab8f
Opcode Fuzzy Hash: 265b1d2e13625c6257664dce66bdc64bc7f8940d1b8cbdcde60e1c1d8f3e6b2c
Instruction Fuzzy Hash: 01310AB1A093019FD710EF69D5886AAFBF4FF85314F11892EE888C7251E77499858B83

Function 00017820 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00017872
MultiByteToWideChar.KERNEL32 ref: 000178B5

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: b9a02d50116e34046ed597437ddf509830757fd692d03ea5df579b600d50158b
Instruction ID: e622394fc78a7b5d113ea25e29db2e7b3b1334a23537c2762ee6d423e7cddeef
Opcode Fuzzy Hash: b9a02d50116e34046ed597437ddf509830757fd692d03ea5df579b600d50158b
Instruction Fuzzy Hash: 8E4115B050D3418FD710DF68D48829ABBF0BF86314F14895EE8D88B291E776D889CB43

Function 00011001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00011075
__p__fmode.MSVCRT ref: 0001107A
__p__commode.MSVCRT ref: 00011087

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: 22cc7eb4cc6a36130d1d1c94ae0dbfc9b5c7ef5c980588ec965d80081317a7f8
Instruction ID: b234df4e7b18962c8d57e8b06da4c5e195f5ba8f80e7763a80dc3e42e5cc03e5
Opcode Fuzzy Hash: 22cc7eb4cc6a36130d1d1c94ae0dbfc9b5c7ef5c980588ec965d80081317a7f8
Instruction Fuzzy Hash: 5121D270944281CBD36AEF20C4553E633F1FB18384F648568D6484B25AD7FE98C7CBA1

Function 00011A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00011CD3
Unknown pseudo relocation bit size %d., xrefs: 00011B84

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: d6a1c293123efddde5d1cf091e0fa6e1bedadc5360822f934b9afc086e654edd
Instruction ID: dd0bad909201d7b98a66b910b7acd96a6407044d2ab4a75148cd843fbc9208b5
Opcode Fuzzy Hash: d6a1c293123efddde5d1cf091e0fa6e1bedadc5360822f934b9afc086e654edd
Instruction Fuzzy Hash: 5871E635A082458BDB18DF28D8C06DEBBF2FF84380F258929E99597355D734E8C6CB91

Function 0001AF8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0001ABB8: strlen.MSVCRT ref: 0001ABD2
Part of subcall function 0001ABB8: HeapAlloc.KERNEL32 ref: 0001AC34
Part of subcall function 0001ABB8: MultiByteToWideChar.KERNEL32 ref: 0001AC68
Part of subcall function 0001ABB8: HeapFree.KERNEL32 ref: 0001AC8B

ShellExecuteW.SHELL32 ref: 0001AFEE
HeapFree.KERNEL32 ref: 0001B00F

Strings

open, xrefs: 0001AFDF

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharExecuteMultiShellWidestrlen
String ID: open
API String ID: 2746946616-2758837156
Opcode ID: f49f1091352985b57bc0a6bddf5a96cfc355bf5e73cbe0657b447333590c9d95
Instruction ID: 6519e8293e0e8c07a7f2b8a5847c98b9dbe9998baa153198512e9080f1c7d96f
Opcode Fuzzy Hash: f49f1091352985b57bc0a6bddf5a96cfc355bf5e73cbe0657b447333590c9d95
Instruction Fuzzy Hash: A50162B15093019FD750AFA8D84838EBFF4EB44314F10865DE89897291D7B99688CFD2

Function 00011830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0001189E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0001187F
Unknown error, xrefs: 00011832

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: f7817b56c6d5ccc3494bdefb3eaec5f7c43b4201fb08524ad3499833f3c2ad2f
Instruction ID: 4aa1708b35e4c8d3d8209c710c02f51aafd936a8363206ac3f732e779b339f26
Opcode Fuzzy Hash: f7817b56c6d5ccc3494bdefb3eaec5f7c43b4201fb08524ad3499833f3c2ad2f
Instruction Fuzzy Hash: 04019670408B45CBD340AF15E48845EBFF1FF89354F86889CE9C9472A9DB36D8A8C746

Function 0001AE3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00019AC0: SetWindowLongW.USER32 ref: 00019B24

SendMessageW.USER32 ref: 0001AE78

Strings

An error has occurred during the installation.Please try downloading the installer manually., xrefs: 0001AE42
0, xrefs: 0001AE6D

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: LongMessageSendWindow
String ID: 0$An error has occurred during the installation.Please try downloading the installer manually.
API String ID: 3360111000-109714329
Opcode ID: 6e7929e360fd396a508ecc5023e637170f1c4547890b46f398774a9e30e9fa14
Instruction ID: 282ea3960db6cafe636bd0a165ed1a421b61924edb01b52416a055901d2213a6
Opcode Fuzzy Hash: 6e7929e360fd396a508ecc5023e637170f1c4547890b46f398774a9e30e9fa14
Instruction Fuzzy Hash: 3AF03970A053109FEB10AFB9C8957AABBE8EB45354F408469E95887241E734D844CBD2

Function 00016940 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,00016A71,?,?,?,?,?,?,00000000,00014D84), ref: 00016967
InitializeCriticalSection.KERNEL32(?,?,?,?,00016A71,?,?,?,?,?,?,00000000,00014D84), ref: 000169A4
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00016A71,?,?,?,?,?,?,00000000,00014D84), ref: 000169B0
EnterCriticalSection.KERNEL32(?,?,?,?,00016A71,?,?,?,?,?,?,00000000,00014D84), ref: 000169D8

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: c038d27b4be2dfe5f45b0b62fa942d2cb9308d5a3586fc371adaa26a15f0124b
Instruction ID: 7b51eeedf2b1e3fb1ee6eb1484f8710672de6d053529a0918c517d44337eb383
Opcode Fuzzy Hash: c038d27b4be2dfe5f45b0b62fa942d2cb9308d5a3586fc371adaa26a15f0124b
Instruction Fuzzy Hash: F81156B18051408BE770AB6CFD852D977E8EB24340F654525C482C7215D77AD8C5CB97

Function 00011F00 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,000120CB,?,?,?,?,?,00011768), ref: 00011F0E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,000120CB,?,?,?,?,?,00011768), ref: 00011F35
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,000120CB,?,?,?,?,?,00011768), ref: 00011F3C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,000120CB,?,?,?,?,?,00011768), ref: 00011F5C

Memory Dump Source

Source File: 00000000.00000002.2343201709.0000000000011000.00000020.00000001.01000000.00000003.sdmp, Offset: 00010000, based on PE: true

Associated: 00000000.00000002.2343182130.0000000000010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343225838.000000000001D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343244256.000000000001E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343302549.0000000000022000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000023000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343322663.0000000000026000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2343409082.000000000002F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: ca0509b492ad5f3b8989ad92f93fe9fdcfac0e41346c9ce798b10a06fa93c972
Instruction ID: 95778f14781b08bfc5b5ce5770eaf92deb7634f3e1e56c68491b6b080963f7b8
Opcode Fuzzy Hash: ca0509b492ad5f3b8989ad92f93fe9fdcfac0e41346c9ce798b10a06fa93c972
Instruction Fuzzy Hash: 4EF0CD765002109FD7207FB4EDC859A7BE4EB14744B05017CDD4887315D738A887C792

Analysis Process: setup.exePID: 6136, Parent PID: 5856COMMON

Executed Functions

Function 006851D2 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00685254

Part of subcall function 006BFDC4: InitializeCriticalSection.KERNEL32(006EB5D4,?,00685260,00000000), ref: 006BFDDB

Part of subcall function 00681206: CommandLineToArgvW.SHELL32(?,?,?,?,00000000,?,ignored ,00000000), ref: 00681244
Part of subcall function 00681206: GetLastError.KERNEL32 ref: 0068124E

CoInitializeEx.OLE32(00000000,00000000,00000003,00000000,00000000), ref: 006852C2

Part of subcall function 006C06C0: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 006C06E1

GetVersionExW.KERNEL32(?), ref: 00685354
GetLastError.KERNEL32 ref: 0068535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 006855CB

Strings

Failed to initialize core., xrefs: 00685400
Failed to run untrusted mode., xrefs: 006854F3
Failed to run RunOnce mode., xrefs: 00685459
Failed to run embedded mode., xrefs: 00685481
Failed to run per-machine mode., xrefs: 006854A9
3.11.2.4516, xrefs: 006853C1
Failed to initialize engine state., xrefs: 006852A9
Failed to initialize Cryputil., xrefs: 006852E3
Invalid run mode., xrefs: 00685436
Failed to initialize COM., xrefs: 006852CE
Failed to initialize XML util., xrefs: 00685336
Failed to run per-user mode., xrefs: 006854D1
Failed to initialize Wiutil., xrefs: 0068531E
Failed to get OS info., xrefs: 0068538C
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00685382
Failed to parse command line., xrefs: 00685282
Failed to initialize Regutil., xrefs: 00685306

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.2.4516$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3262001429-313893568
Opcode ID: f01836c809274405146af0bc61059495a8224db602cbc5639f67f20cdbfd459e
Instruction ID: edc438267b9ee5d1179e2aeb4d19ef8dd2cf10a17dbc0d72c157767007861135
Opcode Fuzzy Hash: f01836c809274405146af0bc61059495a8224db602cbc5639f67f20cdbfd459e
Instruction Fuzzy Hash: D2B1C371D40A299BDB61BFA48C55FED76B7AF04700F0102DDF90AB6251EA709E80CF96

Function 006C28BD Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,006C2F88,00000000), ref: 006C28D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,006C2F88,00000000,?,00000000), ref: 006C28E3
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 006C2923
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006C292F
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 006C293A
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006C2944
CoCreateInstance.OLE32(006EB688,00000000,00000001,006CA878,?), ref: 006C297F
ExitProcess.KERNEL32 ref: 006C2A2E

Strings

kernel32.dll, xrefs: 006C28C7
Wow64EnableWow64FsRedirection, xrefs: 006C2931
Wow64DisableWow64FsRedirection, xrefs: 006C2929
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C2907
Wow64RevertWow64FsRedirection, xrefs: 006C293C
IsWow64Process, xrefs: 006C291D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-3734847636
Opcode ID: c940b8f08a1e8d179faf8fb979049a5d651d843003c1d9a1ceb7e5542eef77dd
Instruction ID: 2cc4253fab2a04f378a529a561de2e3485c8d698bbb40c296508feb7025f0e29
Opcode Fuzzy Hash: c940b8f08a1e8d179faf8fb979049a5d651d843003c1d9a1ceb7e5542eef77dd
Instruction Fuzzy Hash: 1A418F31A02356ABDB219FE988A4FBEBBA6EF44714F11016CED02EB341D775DD418B90

Function 00681070 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 73fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006834C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006810DD,?,00000000), ref: 006834E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000,00000000,00000000,00000001), ref: 006810F6
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000,00000001), ref: 00681131

Strings

msasn1.dll, xrefs: 006810C3
comres.dll, xrefs: 006810B5
version.dll, xrefs: 006810A7
feclient.dll, xrefs: 006810D1
cabinet.dll, xrefs: 00681099
crypt32.dll, xrefs: 006810CA
msi.dll, xrefs: 006810A0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: File$CloseCreateHandleModuleName
String ID: cabinet.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll
API String ID: 2106025501-1933126308
Opcode ID: 40ed003dc155ebc428c3ac42515f8fbb9b5d7804ca8e8e83bfc10dca7d84f5af
Instruction ID: 66f9f1bd9711159d019a07724f032fe5b3139099ba17b97866de872f784abc90
Opcode Fuzzy Hash: 40ed003dc155ebc428c3ac42515f8fbb9b5d7804ca8e8e83bfc10dca7d84f5af
Instruction Fuzzy Hash: 8B216A7190021CABCB50AFE4DC4DFEEBBFAEB45718F508219E651BB280D7B059058BA5

Function 00699F8F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed to copy working folder., xrefs: 00699FEA
Failed to calculate working folder to ensure it exists., xrefs: 00699FAC
Failed create working folder., xrefs: 00699FC2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 955365c4605c3df3c02cffadb44c8edcf3582f93e6ae79d95903a45ac494ae39
Instruction ID: 7f4a01d88f869a7b24ff0f9afca2a5fe9be8f833d0391f63e410b3d52e02d42e
Opcode Fuzzy Hash: 955365c4605c3df3c02cffadb44c8edcf3582f93e6ae79d95903a45ac494ae39
Instruction Fuzzy Hash: CD018F32905525FB8F226B99DD06CAEFB7FDF91B61721425AF800B6614DA718F00E6A0

Function 0068F981 Relevance: 114.2, APIs: 3, Strings: 62, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Registration, xrefs: 0068F99B
Failed to select ARP node., xrefs: 0068FAED
DisableModify, xrefs: 0068FC94
Failed to get @UpdateUrl., xrefs: 0068FC11
Failed to get @Tag., xrefs: 0068FA08
PerMachine, xrefs: 0068FAB0
Failed to get @DisplayVersion., xrefs: 0068FB58
Comments, xrefs: 0068FC47
Failed to get @ProductFamily., xrefs: 0068FE51
AboutUrl, xrefs: 0068FBD5
ExecutableName, xrefs: 0068FA92
Update, xrefs: 0068FDBC
Classification, xrefs: 0068FE80
Failed to parse software tag., xrefs: 0068FDAE
Version, xrefs: 0068FA2F
Failed to get @DisplayName., xrefs: 0068FB33
Failed to get @PerMachine., xrefs: 0068FAC3
DisplayVersion, xrefs: 0068FB41
Failed to parse related bundles, xrefs: 0068FA21
Failed to get @Id., xrefs: 0068F9E7
Failed to select Update node., xrefs: 0068FDDA
UpdateUrl, xrefs: 0068FBFA
Failed to get @AboutUrl., xrefs: 0068FBEC
Manufacturer, xrefs: 0068FDF1
HelpLink, xrefs: 0068FB8B
Publisher, xrefs: 0068FB66
Tag, xrefs: 0068F9F5
Failed to get @Comments., xrefs: 0068FC5E
Failed to get @ProviderKey., xrefs: 0068FA84
DisplayName, xrefs: 0068FB1C
Failed to get @HelpLink., xrefs: 0068FBA2
Failed to get @Name., xrefs: 0068FE72
HelpTelephone, xrefs: 0068FBB0
Failed to get @DisableRemove., xrefs: 0068FD7E
Arp, xrefs: 0068FAD1
BTh, xrefs: 0068F981
DisableRemove, xrefs: 0068FD67
Failed to get @DisableModify., xrefs: 0068FD56
Failed to get @ExecutableName., xrefs: 0068FAA5
ParentDisplayName, xrefs: 0068FC1F
ProductFamily, xrefs: 0068FE3A
button, xrefs: 0068FCB3
Failed to get @Department., xrefs: 0068FE2C
Failed to get @Contact., xrefs: 0068FC86
Failed to get @HelpTelephone., xrefs: 0068FBC7
Failed to get @Classification., xrefs: 0068FE93
Failed to get @Manufacturer., xrefs: 0068FE04
Invalid modify disabled type: %ls, xrefs: 0068FD32
Failed to get @Publisher., xrefs: 0068FB7D
Name, xrefs: 0068FE5F
Department, xrefs: 0068FE15
Failed to get @Version., xrefs: 0068FA42
Failed to parse @Version: %ls, xrefs: 0068FA63
yes, xrefs: 0068FCD4
Contact, xrefs: 0068FC6F
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0068FD25
Failed to get @Register., xrefs: 0068FB0E
Failed to set registration paths., xrefs: 0068FEA6
Failed to select registration node., xrefs: 0068F9BA
Failed to get @ParentDisplayName., xrefs: 0068FC36
ProviderKey, xrefs: 0068FA71
Register, xrefs: 0068FAFB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$BTh$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\66\s\src\burn\engine\registration.cpp$yes
API String ID: 760788290-115505083
Opcode ID: acdad49c4d7f70e95b113f9f2fb0281f62b9facf6317a8e641f75f0f20d99fb5
Instruction ID: 19680234d9eb6379cf89a6a07bad88d67d0ae381d6d75119c612e28be0811204
Opcode Fuzzy Hash: acdad49c4d7f70e95b113f9f2fb0281f62b9facf6317a8e641f75f0f20d99fb5
Instruction Fuzzy Hash: 84E19232E80626BBDB21BB60CC55FBD7AA7AB14B10F12037AFD20B73A1D7619D015784

Function 0068B45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,76EDC3F0,00000000), ref: 0068B4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B51F
GetLastError.KERNEL32(?,?,?,?,76EDC3F0,00000000), ref: 0068B525
ReadFile.KERNELBASE(?,?,00000040,?,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B56D
GetLastError.KERNEL32(?,?,?,?,76EDC3F0,00000000), ref: 0068B573
SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B5D6
ReadFile.KERNELBASE(?,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B625
SetFilePointerEx.KERNELBASE(?,?,00000000,00000000,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B69C
ReadFile.KERNEL32(?,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B6EB
ReadFile.KERNEL32(?,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B73A
SetFilePointerEx.KERNELBASE(?,?,00000000,00000000,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B78C

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

ReadFile.KERNEL32(?,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B7DF
ReadFile.KERNEL32(?,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B841
SetFilePointerEx.KERNELBASE(?,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B8D5

Strings

Failed to seek to NT header., xrefs: 0068B601
(, xrefs: 0068B7EC
Failed to seek to start of file., xrefs: 0068B550
Failed to read complete image section header, index: %u, xrefs: 0068BB44
Failed to read section info, unsupported version: %08x, xrefs: 0068B9C4
Failed to read section info., xrefs: 0068B968
Failed to read section info, data to short: %u, xrefs: 0068B879
Failed to open handle to engine process path., xrefs: 0068B4FC
Failed to read DOS header., xrefs: 0068B59E
Failed to read signature size., xrefs: 0068B765
Failed to allocate memory for container sizes., xrefs: 0068BAA2
Failed to read complete section info., xrefs: 0068B994
Failed to find Burn section., xrefs: 0068BB01
.wix, xrefs: 0068B7FF
PE, xrefs: 0068B667
Failed to get total size of bundle., xrefs: 0068B9F2
4, xrefs: 0068B853
Failed to read NT header., xrefs: 0068B650
Failed to find valid NT image header in buffer., xrefs: 0068BB9F
burn, xrefs: 0068B807
Failed to seek to section info., xrefs: 0068B6C7, 0068B903
PE Header from file didn't match PE Header in memory., xrefs: 0068BAE0
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 0068B4F2, 0068B546, 0068B594, 0068B5F7, 0068B646, 0068B6BD, 0068B70C, 0068B75B, 0068B7B0, 0068B867, 0068B8A7, 0068B8F9, 0068B95E, 0068B988, 0068B9AF, 0068BA96, 0068BAD6, 0068BAF5, 0068BB32, 0068BB70, 0068BB93, 0068BBAE
Failed to seek past optional headers., xrefs: 0068B7BA
Failed to read image section header, index: %u, xrefs: 0068BB7B
Failed to read signature offset., xrefs: 0068B716
Failed to allocate buffer for section info., xrefs: 0068B8B3
Failed to find valid DOS image header in buffer., xrefs: 0068BBBA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3411815225-1671293494
Opcode ID: 83a72eb3543107c84697730e25f31f018f92b1fe8d79e69e6e9a6d931563ace9
Instruction ID: d268161a642ebfe4f868d25904fea20533e87b415c511b788f7c6ff009e8ef82
Opcode Fuzzy Hash: 83a72eb3543107c84697730e25f31f018f92b1fe8d79e69e6e9a6d931563ace9
Instruction Fuzzy Hash: F012C672A40235ABDB30AA548D46FAB76A6EF40B10F0112ADFD05BB380E7759D418BE5

Function 006A0ABB Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,006A066B,?,?), ref: 006A0ACA
GetLastError.KERNEL32(?,?,?,?,006A066B,?,?), ref: 006A0AD4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,006A066B,?,?), ref: 006A0B19
GetLastError.KERNEL32(?,?,?,?,006A066B,?,?), ref: 006A0B24
ResetEvent.KERNEL32(?,?,?,?,?,006A066B,?,?), ref: 006A0B5C
GetLastError.KERNEL32(?,?,?,?,006A066B,?,?), ref: 006A0B66

Strings

Failed to create file: %ls, xrefs: 006A0DA6
Failed to reset begin operation event., xrefs: 006A0B94, 006A0CD0
Failed to set file pointer to end of file., xrefs: 006A0DF4
Failed to set end of file., xrefs: 006A0E39
Failed to allocate buffer for stream., xrefs: 006A0D38
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A0AF8, 006A0B48, 006A0B8A, 006A0BB6, 006A0C39, 006A0C81, 006A0CC6, 006A0D2E, 006A0D99, 006A0DEA, 006A0E2F, 006A0E73
Failed to set operation complete event., xrefs: 006A0B02, 006A0C43
Failed to wait for begin operation event., xrefs: 006A0B52, 006A0C8B
Failed to set file pointer to beginning of file., xrefs: 006A0E7D
Failed to copy stream name: %ls, xrefs: 006A0BF5
Invalid operation for this state., xrefs: 006A0BC2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-1830388895
Opcode ID: f45f70a0112f1b1f9436c96230f3d2b4ba24c30b2fae94dfd1a3c3afdc304c58
Instruction ID: b603d73b6027c58b34646705bccba88f810a5a81413de3fe6a87a9fbf63b5c89
Opcode Fuzzy Hash: f45f70a0112f1b1f9436c96230f3d2b4ba24c30b2fae94dfd1a3c3afdc304c58
Instruction Fuzzy Hash: 5E91E677E81636B7F32036A44D09FA66957BF02B64F120325FE01BF3D1D66A9C009AE5

Function 00684D7A Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006834C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006810DD,?,00000000), ref: 006834E5

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00684F81
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00684F90
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00684F9F
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00684FAA

Strings

-%ls="%ls", xrefs: 00684E27
burn.clean.room, xrefs: 00684E1F
%ls %ls, xrefs: 00684E96
Failed to wait for clean room process: %ls, xrefs: 00684F64
"%ls" %ls, xrefs: 00684EBB
Failed to allocate full command-line., xrefs: 00684ECF
Failed to allocate parameters for unelevated process., xrefs: 00684E3B
burn.filehandle.attached, xrefs: 00684E58
D, xrefs: 00684EEA
Failed to append %ls, xrefs: 00684E5D
Failed to get path for current process., xrefs: 00684DC4
Failed to launch clean room process: %ls, xrefs: 00684F38
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00684F2B
burn.filehandle.self, xrefs: 00684E86
Failed to cache to clean room., xrefs: 00684E03
Failed to append original command line., xrefs: 00684EAA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3884789274-3026910944
Opcode ID: 2a20172a29adf17b965b21d60d6b5bdca20f2e88cc7fc26df944ec7907eda664
Instruction ID: ca0204ab874a431a750ce05cdb151ed6330dab973ea9c04f5b30ee443e843f76
Opcode Fuzzy Hash: 2a20172a29adf17b965b21d60d6b5bdca20f2e88cc7fc26df944ec7907eda664
Instruction Fuzzy Hash: 48715372D4022AABCB11ABE4CC45EEEBB7AEF04714F11421AFA10B6251DB745A41CBA5

Function 0069741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to open attached UX container., xrefs: 00697481
Failed to set original source variable., xrefs: 0069765D
Failed to get source process folder from path., xrefs: 00697618
Failed to set source process path variable., xrefs: 006975FC
Failed to overwrite the %ls built-in variable., xrefs: 006975AE
Failed to get manifest stream from container., xrefs: 006974BF
Failed to initialize variables., xrefs: 00697464
Failed to initialize internal cache functionality., xrefs: 00697692
WixBundleSourceProcessPath, xrefs: 006975EB
Failed to load catalog files., xrefs: 00697702
Failed to get unique temporary folder for bootstrapper application., xrefs: 006976C1
WixBundleUILevel, xrefs: 006975C9, 006975DA
Failed to open manifest stream., xrefs: 0069749E
WixBundleSourceProcessFolder, xrefs: 00697627
Failed to parse command line., xrefs: 0069755A
Failed to extract bootstrapper application payloads., xrefs: 006976E2
WixBundleOriginalSource, xrefs: 0069764C
Failed to load manifest., xrefs: 006974DB
Failed to set source process folder variable., xrefs: 00697638
WixBundleElevated, xrefs: 00697598, 006975A9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: a65bd1a60abe1cdd2a2053347ef2c11954b8d11893538fd5c0d0539039ae316f
Instruction ID: aeded9c1369d312f6a03f1318201f51d9e367554d9bd42f968a673d99e2a996b
Opcode Fuzzy Hash: a65bd1a60abe1cdd2a2053347ef2c11954b8d11893538fd5c0d0539039ae316f
Instruction Fuzzy Hash: 78A19472E5461ABBCF129BE4CC81EEEB7AEBB04710F01422AF505E7641D771EA0087E5

Function 0068762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0069745E,006853FA,00000000,00685482), ref: 0068764D

Strings

WixBundleVersion, xrefs: 00687ECF
Failed to add built-in variable: %ls., xrefs: 00687F1A
WixBundleInstalled, xrefs: 00687E2B
', xrefs: 006878EC
0, xrefs: 00687664
WixBundleActiveParent, xrefs: 00687E63
WixBundleTag, xrefs: 00687EAF
WixBundleForcedRestartPackage, xrefs: 00687E15
WixBundleProviderKey, xrefs: 00687E7F
WixBundleSourceProcessPath, xrefs: 00687E8F
InstallerName, xrefs: 00687813
WixBundleAction, xrefs: 00687D77
WixBundleExecutePackageCacheFolder, xrefs: 00687D99
LogonUser, xrefs: 00687883
WixBundleUILevel, xrefs: 00687EBF
WixBundleSourceProcessFolder, xrefs: 00687E9F
#, xrefs: 006876CC
WixBundleExecutePackageAction, xrefs: 00687DF9
Date, xrefs: 00687771
InstallerVersion, xrefs: 00687834
$, xrefs: 00687D4A
WixBundleElevated, xrefs: 00687E47

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: ef63075cb380ae39bcee914b221b766d19e3172c6f9ea9ab2f1f690eecd7b6b0
Instruction ID: 879cd47bafee0154587d1b91963ed12c39cbe8b060f112be7d3523cb43f3a0ed
Opcode Fuzzy Hash: ef63075cb380ae39bcee914b221b766d19e3172c6f9ea9ab2f1f690eecd7b6b0
Instruction Fuzzy Hash: AD3247B0C116699BDB65CF5AC9897DDFAB6FB49304F9091EED20CA6211C7B00B88CF45

Function 006985B1 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 006985F4
GetLastError.KERNEL32 ref: 00698601

Part of subcall function 006C3709: ReadFile.KERNELBASE(?,?,00000000,?,00000000,00000000,00000000,00000000,?,0069867D), ref: 006C379F

SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006986AE
GetLastError.KERNEL32 ref: 006986B8
FindCloseChangeNotification.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006987E3

Strings

Failed to zero out original data offset., xrefs: 006987D5
Failed to create engine file at path: %ls, xrefs: 00698632
Failed to seek to beginning of engine file: %ls, xrefs: 0069865A
Failed to update signature offset., xrefs: 00698702
Failed to copy engine from: %ls to: %ls, xrefs: 00698689
Failed to seek to signature table in exe header., xrefs: 0069874D
Failed to seek to original data in exe burn section header., xrefs: 006987BC
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00698625, 006986DC, 00698743, 006987B2
Failed to seek to checksum in exe header., xrefs: 006986E6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: File$ErrorLast$ChangeCloseCreateFindNotificationPointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3608016165-2672928773
Opcode ID: 221838318f3989b9ccfc9f48b500fea05115e6809d912a952c86041601d2cda6
Instruction ID: 62f58d89cd61cc1541534ddcb81a5420cf6698821b9995c897e06001e6b8f93f
Opcode Fuzzy Hash: 221838318f3989b9ccfc9f48b500fea05115e6809d912a952c86041601d2cda6
Instruction Fuzzy Hash: 6551D5B2E405316FEB116BA48C46FBF766EEB05B10F120119FE01FF681EA659C0086E5

Function 0069819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,?), ref: 006981F5

Part of subcall function 006C0141: OpenProcessToken.ADVAPI32(?,00000008,?,?,00000000,?,?,?,?,00698201,00000000), ref: 006C015F
Part of subcall function 006C0141: GetLastError.KERNEL32(?,?,?,?,00698201,00000000), ref: 006C0169
Part of subcall function 006C0141: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00698201,00000000), ref: 006C01F3

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 0069821B
GetLastError.KERNEL32 ref: 00698225
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 006982A2
GetLastError.KERNEL32 ref: 006982AC
UuidCreate.RPCRT4(?), ref: 006982EB

Strings

Failed to create working folder guid., xrefs: 006982F8
Failed to append bundle id on to temp path for working folder., xrefs: 00698355
Failed to copy working folder path., xrefs: 00698370
Failed to convert working folder guid into string., xrefs: 0069832B
Temp\, xrefs: 0069827A
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00698249, 006982D0, 00698321
%ls%ls\, xrefs: 0069833D
Failed to get windows path for working folder., xrefs: 00698253
Failed to get temp path for working folder., xrefs: 006982DA
Failed to concat Temp directory on windows path for working folder., xrefs: 00698292
Failed to ensure windows path for working folder ended in backslash., xrefs: 00698270

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2898636500-2821718772
Opcode ID: 3459c5f97858159876498dc3c86e9eec09a377bcf041fe7a779cbc1d2e1eaf74
Instruction ID: 2c605b1520307c0ae03fdc7c351a7f57afb9e8defef7ea70aa55a6f559a6275a
Opcode Fuzzy Hash: 3459c5f97858159876498dc3c86e9eec09a377bcf041fe7a779cbc1d2e1eaf74
Instruction Fuzzy Hash: 3041E772E40735BBDB20A7F4CC0AFAA73AEAB05B11F110166F905FB640EA74DE0486D5

Function 006A0EA0 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 006A0EC2
CoUninitialize.OLE32 ref: 006A113D

Strings

Failed to initialize COM., xrefs: 006A0ECE
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 006A101E
Failed to reset begin operation event., xrefs: 006A10F5
Failed to initialize cabinet.dll., xrefs: 006A0F44
Failed to set operation complete event., xrefs: 006A1069
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A0F38, 006A105F, 006A10AC, 006A10EB, 006A1117
Failed to wait for begin operation event., xrefs: 006A10B6
Invalid operation for this state., xrefs: 006A1121
<the>.cab, xrefs: 006A0F62

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-964446333
Opcode ID: 08c5d348d9454524fbb6918ac7d7bdac247204593b6a6a9b2c8a4f338622c2ac
Instruction ID: db51253275bca61088792ab52e7a13e3591c0ea5e0667872808eecca3b2c783c
Opcode Fuzzy Hash: 08c5d348d9454524fbb6918ac7d7bdac247204593b6a6a9b2c8a4f338622c2ac
Instruction Fuzzy Hash: 21513C77D40272E7972077A59C01EBB75179B43B24F26026AFD01BF380D96E8C819EE5

Function 00684326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 00684352
InitializeCriticalSection.KERNEL32(?), ref: 0068435B
lstrlenW.KERNEL32(burn.filehandle.attached,?,?), ref: 006843A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000), ref: 006843AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000), ref: 006843BF
lstrlenW.KERNEL32(burn.filehandle.attached), ref: 006843CF
lstrlenW.KERNEL32(burn.filehandle.self), ref: 0068441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000), ref: 00684429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000), ref: 0068443D
lstrlenW.KERNEL32(burn.filehandle.self), ref: 0068444D

Strings

Failed to parse file handle: '%ls', xrefs: 006844CF
Missing required parameter for switch: %ls, xrefs: 006844F1
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 006844E2, 0068450E
Failed to initialize engine section., xrefs: 006844B6
burn.filehandle.self, xrefs: 0068441A, 00684422, 00684427, 00684428, 00684448, 00684518
burn.filehandle.attached, xrefs: 0068439C, 006843A4, 006843A9, 006843AA, 006843CA, 006844EC

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3039292287-2540856168
Opcode ID: 02e0da2cc97fd1a599baf5d78e5b23b27b07b154b97408d7663fbd7d193fd9d3
Instruction ID: a9bc04316975782b217507f0f7dd128bf22b5895b13ecd8a9c1ee39f984ada35
Opcode Fuzzy Hash: 02e0da2cc97fd1a599baf5d78e5b23b27b07b154b97408d7663fbd7d193fd9d3
Instruction Fuzzy Hash: 2351FA71A4021ABFC714AFA8CC46FAA779FFF00724F05421AF615D7290DBB4A950CBA5

Function 006C2368 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006838D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00683910
Part of subcall function 006838D1: GetLastError.KERNEL32 ref: 0068391A

Part of subcall function 006C4289: GetLastError.KERNEL32(00000100,00000000,00000100,00000000,00000000,00000000,000000B8,00000100,00000000,000002C0,00000100,00000000), ref: 006C42BA

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 006C23B2
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 006C23D2
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 006C23F2
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 006C2412
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 006C2432
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 006C2452
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 006C2472

Strings

MsiEnumProductsExW, xrefs: 006C23E7
MsiSetExternalUIRecord, xrefs: 006C2447
MsiGetProductInfoExW, xrefs: 006C2427
Msi.dll, xrefs: 006C237A
MsiDetermineApplicablePatchesW, xrefs: 006C23C7
MsiSourceListAddSourceExW, xrefs: 006C2467
MsiDeterminePatchSequenceW, xrefs: 006C23A7
MsiGetPatchInfoExW, xrefs: 006C2407

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: fc3335d7c2316015cdcb404d37eb36d69a030a8c754a226da2ede42b9d8b05ff
Instruction ID: bb2ef7b4bbb6ae1f330c509c62e508c9b87a4278b70bf3102c6e9a1924564615
Opcode Fuzzy Hash: fc3335d7c2316015cdcb404d37eb36d69a030a8c754a226da2ede42b9d8b05ff
Instruction Fuzzy Hash: AC3126B09027DAEBDB129F61ECA5B6B3BE3F700708F10712AE4005A2B1D7B10955CF48

Function 0068C252 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 131fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,BTh,0068C442,BTh,?,?,00685482), ref: 0068C299
GetLastError.KERNEL32 ref: 0068C2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,BTh,0068C442,BTh,?,?,00685482,00685482,00000000,?), ref: 0068C2F9
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 0068C2FF
DuplicateHandle.KERNELBASE(00000000), ref: 0068C302
GetLastError.KERNEL32 ref: 0068C30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 0068C35E
GetLastError.KERNEL32 ref: 0068C368

Strings

Failed to move file pointer to container offset., xrefs: 0068C396
Failed to duplicate handle to container: %ls, xrefs: 0068C33D
c:\agent\_work\66\s\src\burn\engine\container.cpp, xrefs: 0068C2CE, 0068C330, 0068C38C
BTh, xrefs: 0068C252
Failed to open file: %ls, xrefs: 0068C2DB
Failed to open container., xrefs: 0068C3B4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: BTh$Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\66\s\src\burn\engine\container.cpp
API String ID: 2619879409-1098651244
Opcode ID: 1e813d99c7cad0340a9f374c516a36d1bcf1bed32f9a35bacef3c6875d3cfc42
Instruction ID: 7317628ad4761bb995aa3de6a39ab5913fd5a94385f49a8d34dec4dca4b76e49
Opcode Fuzzy Hash: 1e813d99c7cad0340a9f374c516a36d1bcf1bed32f9a35bacef3c6875d3cfc42
Instruction Fuzzy Hash: D241F476140211ABD720AF699C45E6B3BB7EBC5730F218219FD14AB381E636C802DBB5

Function 006BF58A Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 006BF5B2
GetProcAddress.KERNEL32(SystemFunction041), ref: 006BF5C4
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 006BF607
GetLastError.KERNEL32 ref: 006BF61B
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 006BF653
GetLastError.KERNEL32 ref: 006BF667

Strings

AdvApi32.dll, xrefs: 006BF591
c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 006BF63C
Crypt32.dll, xrefs: 006BF5E8
CryptProtectMemory, xrefs: 006BF5FC
CryptUnprotectMemory, xrefs: 006BF648
SystemFunction040, xrefs: 006BF5A7
`+>s, xrefs: 006BF5C6, 006BF5CD, 006BF655
SystemFunction041, xrefs: 006BF5B4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$`+>s$c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-2541391272
Opcode ID: b694688eb5773f3d016f7fa77e8c29cc7c65b42c72e0499cce55c531d74616bc
Instruction ID: 0da913c5df8b591a2cf90241df69b0bdd10a1d99df96f25decb3ed9aab8b9276
Opcode Fuzzy Hash: b694688eb5773f3d016f7fa77e8c29cc7c65b42c72e0499cce55c531d74616bc
Instruction Fuzzy Hash: 722186B29427B267D3315F599C85B977A53A710754F022239EC01BE370F7648C818F94

Function 006A14E3 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000000,00000000,00000000,?,?,0068C3AE,?,?), ref: 006A151A
GetLastError.KERNEL32(?,0068C3AE,?,?), ref: 006A1523

Strings

Failed to wait for operation complete., xrefs: 006A15F6
Failed to create begin operation event., xrefs: 006A1551
Failed to create extraction thread., xrefs: 006A15E3
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A1547, 006A158D, 006A15D9
Failed to copy file name., xrefs: 006A1505
Failed to create operation complete event., xrefs: 006A1597

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 545576003-2015552351
Opcode ID: e138f3a05cdad1a483e1f200e97a635cb7fff366f24cf981f37192df5a4e71fd
Instruction ID: 715e02a9e7eb54696d323a47792969422c4b457067fd785d69af83f7bbb0ee00
Opcode Fuzzy Hash: e138f3a05cdad1a483e1f200e97a635cb7fff366f24cf981f37192df5a4e71fd
Instruction Fuzzy Hash: 9A21C4F3D41A3A77A32122A58D45E6769AFAF43BA4F020216FD41BF380E664DC004AE4

Function 006A0671 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 006A06A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 006A06B9
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 006A06BE
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 006A06C1
GetLastError.KERNEL32(?,?), ref: 006A06CB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 006A073A
GetLastError.KERNEL32(?,?), ref: 006A0747

Strings

Failed to add virtual file pointer for cab container., xrefs: 006A0720
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A06EF, 006A076B
Failed to open cabinet file: %hs, xrefs: 006A0778
Failed to duplicate handle to cab container., xrefs: 006A06F9
<the>.cab, xrefs: 006A069A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-886985619
Opcode ID: 8521c03414ddcbe43cc725935814b5714f2458b745286c67064958e4ebd3c33d
Instruction ID: f8f95035114b8d8298bb797fa4074a9dadee91ad395b5c97f03b30d5acb17536
Opcode Fuzzy Hash: 8521c03414ddcbe43cc725935814b5714f2458b745286c67064958e4ebd3c33d
Instruction Fuzzy Hash: 09310172D0163ABBE7216B948D49E9B7E6BEF06B64F120115FD04BB240D674AD008EE4

Function 00696955 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00684E52,?,?), ref: 00696975
GetCurrentProcess.KERNEL32(?,00000000,?,?,00684E52,?,?), ref: 0069697B
DuplicateHandle.KERNELBASE(00000000,?,?,00684E52,?,?), ref: 0069697E
GetLastError.KERNEL32(?,?,00684E52,?,?), ref: 00696988
CloseHandle.KERNEL32(000000FF,?,00684E52,?,?), ref: 00696A01

Strings

RNh, xrefs: 006969CB, 006969D3, 006969DA
Failed to append the file handle to the command line., xrefs: 006969E9
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 006969AC
%ls -%ls=%u, xrefs: 006969D5
burn.filehandle.attached, xrefs: 006969CE
Failed to duplicate file handle for attached container., xrefs: 006969B6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$RNh$burn.filehandle.attached$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 4224961946-2654098044
Opcode ID: 27f8743d42b7f56da0397022d6b4495dd11563c727e2a5d577c13e35199ddb43
Instruction ID: 379979556ffa9303dda6b0fda471536857671a9726de1f2f909282dac3d5d921
Opcode Fuzzy Hash: 27f8743d42b7f56da0397022d6b4495dd11563c727e2a5d577c13e35199ddb43
Instruction Fuzzy Hash: 24118172A41326BBCB10ABA4CD05E9ABBAEAB01B70F114316F911F72D0D7749E0196A4

Function 006C0141 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,?,00000000,?,?,?,?,00698201,00000000), ref: 006C015F
GetLastError.KERNEL32(?,?,?,?,00698201,00000000), ref: 006C0169
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,00698201,00000000), ref: 006C019B
GetLastError.KERNEL32(?,?,?,?,00698201,00000000), ref: 006C01B4
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00698201,00000000), ref: 006C01F3

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 006C01E1

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-2457365779
Opcode ID: a306fe3a3375b627dba9cb6502b6a581cbeb1a324f34994a179d5459ad67588b
Instruction ID: 35db4a4d2dbbf0dbe96fec308f5f769e947c3981f9d9d44f073d0914080bd66d
Opcode Fuzzy Hash: a306fe3a3375b627dba9cb6502b6a581cbeb1a324f34994a179d5459ad67588b
Instruction Fuzzy Hash: CC219276E41229EBEB219BD58C08FBEFAA9EF00754F16415AED05BB650D2708F009AD0

Function 00696A0F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,000000FF,00000003,00000080,00000000,00000000,00000000,00000000,000000FF,?), ref: 00696A43
CloseHandle.KERNEL32(00000000), ref: 00696AB3

Strings

Failed to append the file handle to the obfuscated command line., xrefs: 00696AA1
Failed to append the file handle to the command line., xrefs: 00696A6F
%ls -%ls=%u, xrefs: 00696A5B, 00696A8D
burn.filehandle.self, xrefs: 00696A54, 00696A86

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: a13cba97f64b246f2193b0d49ba3c04a7b72064006992b783b3440778427ed88
Instruction ID: c9805f29d81bdb3a20f3e34fb0b5437d92067d1cee9af4a965804a3b98a511f3
Opcode Fuzzy Hash: a13cba97f64b246f2193b0d49ba3c04a7b72064006992b783b3440778427ed88
Instruction Fuzzy Hash: 2211C831A41314BBCF21ABA9DC45FAF3BAEAB41B74F114316F920B73D1D67049118791

Function 006C2DC7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006C2DD6
InterlockedIncrement.KERNEL32(006EB69C), ref: 006C2DF3
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,006EB688), ref: 006C2E0E
CLSIDFromProgID.OLE32(MSXML.DOMDocument,006EB688), ref: 006C2E1A

Strings

Msxml2.DOMDocument, xrefs: 006C2E09
MSXML.DOMDocument, xrefs: 006C2E15

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 05e7c9bb9734facfa1c331ee7680acf12d24e426d136b320b46fea8b658ba05b
Instruction ID: 4d70e4231102b3b49dc69c3ddf80409d56a29d872377fe0a0d008608429d3eeb
Opcode Fuzzy Hash: 05e7c9bb9734facfa1c331ee7680acf12d24e426d136b320b46fea8b658ba05b
Instruction Fuzzy Hash: D3F0A0307413BB97D7221BA2AC1CF7B2F6BDBA4B59F41301CEC02E5150C76498418AE1

Function 006C4289 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000100,00000000,00000100,00000000,00000000,00000000,000000B8,00000100,00000000,000002C0,00000100,00000000), ref: 006C42BA
GlobalAlloc.KERNEL32(00000000,00000000,00000100,00000000,00000100,00000000,00000000,00000000,000000B8,00000100,00000000,000002C0,00000100,00000000), ref: 006C42E7
GetLastError.KERNEL32(?,?,?,00000000), ref: 006C4313
GetLastError.KERNEL32(00000000,006CA800,?,?,?,?,?,00000000), ref: 006C4351
GlobalFree.KERNEL32(00000000), ref: 006C4382

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C42D5, 006C432E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1688708105
Opcode ID: a56f440435849a84fa8a262c9c5608a097f9468175b2a31f29dc747a8844821c
Instruction ID: 1fa165f204285995e8c42ba3b6cac912d67b0b081b01c82f30a18c0d4b7ca911
Opcode Fuzzy Hash: a56f440435849a84fa8a262c9c5608a097f9468175b2a31f29dc747a8844821c
Instruction Fuzzy Hash: 0431B336940279ABC721DA968C51FFFBAA6EF94750F11421AFD08E7341DA34DD0086D4

Function 006A082C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 006A08D2
GetLastError.KERNEL32(?,?,?), ref: 006A08DC

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A0900
Failed to move file pointer 0x%x bytes., xrefs: 006A090D
Invalid seek type., xrefs: 006A0868

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-424406494
Opcode ID: fef4516f1bb10e5611e2c56e2e9eadfb95c2baa180524015690ca3791691870f
Instruction ID: 5c021ec2f969481541a80f1cfc1254b6ff0c52c27e7a0a0f4f4282cda2353421
Opcode Fuzzy Hash: fef4516f1bb10e5611e2c56e2e9eadfb95c2baa180524015690ca3791691870f
Instruction Fuzzy Hash: 4931BE71A0021AAFEB00EFA8CC41EA9B7AAFF05364B148129F914A7351D374EE10CFD4

Function 0068415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,?,00682FD9,?,00000000,?,?), ref: 0068416D
GetLastError.KERNEL32(?,00682FD9,?,00000000,?,?), ref: 0068417B
CreateDirectoryW.KERNEL32(?,00000000,?,?,00682FD9,?,00000000,?,?), ref: 006841EB
GetLastError.KERNEL32(?,00682FD9,?,00000000,?,?), ref: 006841F5

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00684225

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-2061300336
Opcode ID: a6aefc8404712acd5796d306293e3b91ea82cdb730f1d2692e48eedca941a883
Instruction ID: b0cd3cba3e5486ee26c1d4fe200c48c51771698d6a8540865ae4a1e78365134e
Opcode Fuzzy Hash: a6aefc8404712acd5796d306293e3b91ea82cdb730f1d2692e48eedca941a883
Instruction Fuzzy Hash: 2F214632644233A7DB213AA15C18BBBB6A7EF65B60F124324FD44EB300DE208D4193D5

Function 006856E2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,00000100,000000FF,?,000000FF,00000000,00000000,00000000,?,?,?,00685DC2,00000000,00000100,00000000), ref: 0068571E
GetLastError.KERNEL32(?,?,?,00685DC2,00000000,00000100,00000000,00000000,00000000,?,?,0068735E,00000000,00000100,00000000), ref: 0068574D

Strings

Failed to compare strings., xrefs: 0068577B
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00685771

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1733990998-322089737
Opcode ID: 73f6a7fc976810efa0f72ad4306bc88d33b5dbb58cebba83244308de7fb26f34
Instruction ID: a4cbc867849aa5f8a58290550ddf5f4dcc7c42766eeae460b6e749a5603a3121
Opcode Fuzzy Hash: 73f6a7fc976810efa0f72ad4306bc88d33b5dbb58cebba83244308de7fb26f34
Instruction Fuzzy Hash: BB21F637600A25EBC7149FA8CD45E99BBA6EF05770F254318E912AB3D0E674ED0187A0

Function 006A0797 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006A11B1: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,006A07C6,?,?,?), ref: 006A11D9
Part of subcall function 006A11B1: GetLastError.KERNEL32(?,006A07C6,?,?,?), ref: 006A11E3

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 006A07D4
GetLastError.KERNEL32 ref: 006A07DE

Strings

Failed to read during cabinet extraction., xrefs: 006A080C
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A0802

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-3499834177
Opcode ID: a16ccbc0eb013c0aeb7f19ca57e6f4d8eaf5e0ed6806cc415079f47d2be32ffb
Instruction ID: ef4379e587857fa94b25517c7d372bfa7a1e9d0ba50580865b5e3cabdfec27aa
Opcode Fuzzy Hash: a16ccbc0eb013c0aeb7f19ca57e6f4d8eaf5e0ed6806cc415079f47d2be32ffb
Instruction Fuzzy Hash: 8D01A576A40269ABDB11AFA4DD04D9A7BAAFF05764F010129FD04A7350D734ED00CBE8

Function 006A11B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,006A07C6,?,?,?), ref: 006A11D9
GetLastError.KERNEL32(?,006A07C6,?,?,?), ref: 006A11E3

Strings

Failed to move to virtual file pointer., xrefs: 006A1211
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A1207

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1387633737
Opcode ID: f47544636d8a343a7b4ff83e9ad997acb8e9e309d429dcc425f55aad478855cd
Instruction ID: cc767e733c5c7f463d76b8511738d70f7f31dc39bb7a4c298fda42209518469c
Opcode Fuzzy Hash: f47544636d8a343a7b4ff83e9ad997acb8e9e309d429dcc425f55aad478855cd
Instruction Fuzzy Hash: B201A7379405367787212B96AC04E9BFF17EF437B1B11812AFD18AA210D635DD508BD4

Function 006C3709 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000,00000000,00000000,00000000,?,0069867D), ref: 006C379F
GetLastError.KERNEL32(?,0069867D), ref: 006C3802

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C3826

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-1688708105
Opcode ID: 0d484c1f12bf7b4b13a91d78fb27d82dd33a9ff15594c9e022f81f3ce33d31ac
Instruction ID: 7580e8484ee283484afd62503cd323d9b2dbb602b0acf9da39c8e90e716b0040
Opcode Fuzzy Hash: 0d484c1f12bf7b4b13a91d78fb27d82dd33a9ff15594c9e022f81f3ce33d31ac
Instruction Fuzzy Hash: D73165B1E012799BDB21DF55CC40BEA76A6FB08751F0080AEF945E7340D6749EC48BA4

Function 006C4650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,006C37C6,?,?,?,?,0069867D), ref: 006C4674
GetLastError.KERNEL32(?,?,006C37C6,?,?,?,?,0069867D), ref: 006C467E

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C46A7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-1688708105
Opcode ID: 4d4e0927c54d6ef146f7dec28a380160aa4ee80416f4f4c6db7b664ec2e1f4f9
Instruction ID: 31021fb635b327331edaa1629f600de550b3bf0bccc12b7b33ba29f89a4c05af
Opcode Fuzzy Hash: 4d4e0927c54d6ef146f7dec28a380160aa4ee80416f4f4c6db7b664ec2e1f4f9
Instruction Fuzzy Hash: 87F06D33A01229ABD711CF9ACD45FEFBBAAEB41761F010119F904EB244DA71A90086E0

Function 006C412E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,006C5B5F,?,?,?,00000000,00000000,00000001), ref: 006C4146
GetLastError.KERNEL32(?,006C5B5F,?,?,?,00000000,00000000,00000001,00000000,?,?,?,006C53FE,?,?,?), ref: 006C4150

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C4174

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-1688708105
Opcode ID: cd8304197145d79f1a4e2c859fd41e363e8356a925bb4735d7d6fef7fb704fc2
Instruction ID: ab4c7f0e97e15f98dd940a61e2d00dfe79fc9486ce435bb9a199ddb24d54ebd6
Opcode Fuzzy Hash: cd8304197145d79f1a4e2c859fd41e363e8356a925bb4735d7d6fef7fb704fc2
Instruction Fuzzy Hash: E3F08172A0022AAB9B21CF85CC15EFB7FAAEF147A0B064118FD44AB250E631DD50D6A4

Function 006838D1 Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00683910
GetLastError.KERNEL32 ref: 0068391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00683983

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 9de9f89129a24d01b29483bd3418b46531ed8818c20f75d49b11c1b4c2b0de37
Instruction ID: 324b088d79358c7ce4280cac0a2c02ff89b666df68a4bb49710ecb8be5a3ec59
Opcode Fuzzy Hash: 9de9f89129a24d01b29483bd3418b46531ed8818c20f75d49b11c1b4c2b0de37
Instruction Fuzzy Hash: 6C21D3B6D0133967CF20BBA48C49F9A77AA9B00B24F110365EE04F7341F6B4DE408B95

Function 00683AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,006BFB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,006BFB1B,000001C7), ref: 00683AAE
RtlFreeHeap.NTDLL(00000000,?,006BFB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,006BFB1B,000001C7,?,?), ref: 00683AB5
GetLastError.KERNEL32(?,006BFB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,006BFB1B,000001C7,?,?), ref: 00683ABF

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 4000d3d901b0d5b2e2098408c1943714113168aefd0b3b4aeb5af37fae21ff8a
Instruction ID: 713fd54056582f21048b503d9a3469a4f45be81401a1da93d86d9ad0728075e6
Opcode Fuzzy Hash: 4000d3d901b0d5b2e2098408c1943714113168aefd0b3b4aeb5af37fae21ff8a
Instruction Fuzzy Hash: 54D01273A0013D57872127E55C0CDA7BE59EF04AE5B054125FD44E6710DA25CD0097E5

Function 006C2E25 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006C2E5A

Part of subcall function 006C28BD: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,006C2F88,00000000), ref: 006C28D7
Part of subcall function 006C28BD: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,006C2F88,00000000,?,00000000), ref: 006C28E3

Strings

BTh, xrefs: 006C2E25

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: BTh
API String ID: 52713655-300020102
Opcode ID: 00e904a9c606ec5290affd8757e058cfe59587a3cf0716c18f3bf3389a95eb0b
Instruction ID: a142907bee36f32ffa80d6c337ae450c348db26cf1d0b77f729d8092c150408f
Opcode Fuzzy Hash: 00e904a9c606ec5290affd8757e058cfe59587a3cf0716c18f3bf3389a95eb0b
Instruction Fuzzy Hash: 0D312D76E006299BCB11DFA8D894AEEB7B5EF0C710F01456AED15FB311D6749D048BA0

Function 006C0823 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C0874

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3237223240
Opcode ID: 1145255864f137761b2fe47c0b77c9f70f318be85a869beea1d2f83dbcec9103
Instruction ID: 2358fef37a83679b4cfb62621c71f87c9cc6f59d8b51c90449da5e95b6f27ef3
Opcode Fuzzy Hash: 1145255864f137761b2fe47c0b77c9f70f318be85a869beea1d2f83dbcec9103
Instruction Fuzzy Hash: 93F09632B42225E3AB3109964C05FB76E47DB44BB0F158129BD49DA354E665CC5093F0

Function 006B7B50 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 006B5929: GetLastError.KERNEL32(?,00000000,006B12E7,00000000,80004004,?,006B15EB,00000000,80004004,00000000,00000000), ref: 006B592D
Part of subcall function 006B5929: _free.LIBCMT ref: 006B5960
Part of subcall function 006B5929: SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006B59A1
Part of subcall function 006B5929: _abort.LIBCMT ref: 006B59A7

Part of subcall function 006B7C6F: _abort.LIBCMT ref: 006B7CA1
Part of subcall function 006B7C6F: _free.LIBCMT ref: 006B7CD5

Part of subcall function 006B78E4: GetOEMCP.KERNEL32(00000000), ref: 006B790F

_free.LIBCMT ref: 006B7BC8
_free.LIBCMT ref: 006B7BFE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 5a582a66f23ec443eb4bbbe757275d50277a312b2f9b6af2eba82325e450e724
Instruction ID: bb6e7ffd32866482e9efc70ff66aca06b5ca1b47696449d18da0ee10b6f313f9
Opcode Fuzzy Hash: 5a582a66f23ec443eb4bbbe757275d50277a312b2f9b6af2eba82325e450e724
Instruction Fuzzy Hash: 6B31A4B1908248AFDB10DFA5D441BE97BE7AF81320F25409DE4045B291DB729E80DF54

Function 006810F2 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00685160: lstrlenW.KERNEL32(burn.clean.room), ref: 0068517F
Part of subcall function 00685160: CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F), ref: 006851AF

CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000,00000001), ref: 00681131

Part of subcall function 006811F8: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,0068110D), ref: 006811FF

Strings

u, xrefs: 006810F2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCompareHandleHeapInformationStringlstrlen
String ID: u
API String ID: 2894272527-4067256894
Opcode ID: 256e800a187e14ad6a517a6745d2d3dd3480188ae76da8edd8b31f5b7233ef74
Instruction ID: b67cc1eeaf089a6021856a5bb46ad91d80d5a5842644a88598725ba697b144eb
Opcode Fuzzy Hash: 256e800a187e14ad6a517a6745d2d3dd3480188ae76da8edd8b31f5b7233ef74
Instruction Fuzzy Hash: 2EF0C832A001186ACB50BAB4DC0DFEE666FAF46764F140319FB92B6281DA248C06D764

Function 00683B7C Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,?,00682375,000001C7,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000), ref: 00683B90
RtlReAllocateHeap.NTDLL(00000000,?,00682375,000001C7,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683B97

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 417387fe6e31291b260986aee47c9980d9b4360d8573e2c74c39c4d6b9635b37
Instruction ID: bdeb3d5ef79c997f266e8dadc9f2ab6815f7e1e3e1fc641592bc0d231a269fac
Opcode Fuzzy Hash: 417387fe6e31291b260986aee47c9980d9b4360d8573e2c74c39c4d6b9635b37
Instruction Fuzzy Hash: 11D0127215420DEFCF005FE8DC0DDBE3BAEFB58606B088405F915C2610C63DE4209B61

Function 006839DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: de082715ac66d2b46262be91d1a55b20cd2147ee0ded8bc6c0890d4e41b03481
Instruction ID: 2958064ae766ab36c48f7b492fc22393f95cd211deecc967e3821bf168322858
Opcode Fuzzy Hash: de082715ac66d2b46262be91d1a55b20cd2147ee0ded8bc6c0890d4e41b03481
Instruction Fuzzy Hash: B3C012721A420CAF8B006FF8EC0ECAA3BADFB28606B088400B906C2610C638E0108B61

Function 006C506B Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,006EAA7C,00000000,00000000,00000000,?,006989F4,WiX\Burn,PackageCache,00000000,006EAA7C,00000000,00000000,00000000), ref: 006C50C5

Part of subcall function 006C095E: RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,00000000,00000088,000000B8,00000088,00000002,000000B8,BundleUpgradeCode,000002C0,00000088,000000B8,00000000), ref: 006C09D4
Part of subcall function 006C095E: RegQueryValueExW.ADVAPI32(?,00000088,00000000,?,00000088,00000088,00000088,?), ref: 006C0A0C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: f86986f66cd4afc666f249448a5d162299d2cb4cab94aaac0a9b7bd2fa246717
Instruction ID: 722d7f3a5a9ee7a9ed9d2463403263f7d5d05836b53ef71b18fff6267f894960
Opcode Fuzzy Hash: f86986f66cd4afc666f249448a5d162299d2cb4cab94aaac0a9b7bd2fa246717
Instruction Fuzzy Hash: 5411C636A0052AEBCB227E948D85FFEB667DB04350B11413DED42A7210C7316D90D7D1

Function 006B5D22 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,006B1782,?,0000015D,?,?,?,?,006B2BDB,000000FF,00000000,?,?), ref: 006B5D54

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3f9821b76138532d908700d01b1de8ccfd5fb563c35aa5a47d257e98ab55327c
Instruction ID: bf447ebea25f6579a625dd2d64a20ba002b8b276c7fdbf929fac7e01fd41f856
Opcode Fuzzy Hash: 3f9821b76138532d908700d01b1de8ccfd5fb563c35aa5a47d257e98ab55327c
Instruction Fuzzy Hash: D0E0E5B1600B2466EB3227625C09BDF368B9F423A0F4D1720ED069A2D1DF50DCC243AC

Function 006835A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,00000104), ref: 006835C8

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 5976250e13f22378d5b7c33d45a122b45da9d8b431c440d55534b3ab682a60ff
Instruction ID: 07060243f10566b62dc9dcb92a431de932a43bb997bd06528e368c43815b706c
Opcode Fuzzy Hash: 5976250e13f22378d5b7c33d45a122b45da9d8b431c440d55534b3ab682a60ff
Instruction Fuzzy Hash: 44E017723412287BAB413AA59C01DBB7B9EEF167A5B004125FF44EB100DA75EA1057B6

Function 006BED6A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006BED51

Part of subcall function 006C90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006C9121
Part of subcall function 006C90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006C9132

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c650d10ac328e6444124f66c845cb0bd88efeb3cf03055bc1579905e81030e26
Instruction ID: 44c8a3ed3556a4c500784c54af139de0fd42e8664799ae2c498836f379167ac5
Opcode Fuzzy Hash: c650d10ac328e6444124f66c845cb0bd88efeb3cf03055bc1579905e81030e26
Instruction Fuzzy Hash: E9B012E536F3427C324452471D4AE76111FC6D1F20332819FF000C5041D8C11D830173

Function 006BED5A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006BED51

Part of subcall function 006C90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006C9121
Part of subcall function 006C90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006C9132

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 49b0c4cfa9f64967a7be0e798f85b04294ee2eb08393d9479b247385450e34e7
Instruction ID: 46cea7637565e6b58d5bfefe1fab252985e39e69cdab744895268d1b7105c39e
Opcode Fuzzy Hash: 49b0c4cfa9f64967a7be0e798f85b04294ee2eb08393d9479b247385450e34e7
Instruction Fuzzy Hash: 7CB012E536F2427D324452471E4BE76111FC6D1F20332409FB000C5041D8C21D430173

Function 006BED39 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006BED51

Part of subcall function 006C90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006C9121
Part of subcall function 006C90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006C9132

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 091e7ed8f5465d6614424f5c124a1b31e3657be5c18db85d5455796aeaec0409
Instruction ID: 6c3af626af1d5793adfb8242a7078a816c52d7831371c607409b91a3b406344c
Opcode Fuzzy Hash: 091e7ed8f5465d6614424f5c124a1b31e3657be5c18db85d5455796aeaec0409
Instruction Fuzzy Hash: 63B012E936F2427C324412431D4AD76151FC6D1F20332809FB400C404198C11D4300B3

Non-executed Functions

Function 006C0FA6 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 006C103E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C1048
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 006C1095
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C109B
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 006C10D5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C10DB
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 006C111B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C1121
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 006C1161
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C1167
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 006C11A7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C11AD
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 006C129E
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 006C12D8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C12E2
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 006C131A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C1324
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006C135D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C1367
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 006C13A5
LocalFree.KERNEL32(?), ref: 006C13BB

Strings

c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 006C1069

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: c:\agent\_work\66\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-212431265
Opcode ID: 225f552b23bb075126a083f3eead928f9b09cdbd245fe6e2b7daea1317f03808
Instruction ID: 149d7aca734d46ccbc396d34772afcbe8f7fc92c81202c504af8b5a94256e5c3
Opcode Fuzzy Hash: 225f552b23bb075126a083f3eead928f9b09cdbd245fe6e2b7daea1317f03808
Instruction Fuzzy Hash: B7C18576D4123DABD7208F958C48FEEBAB9EF46750F01019EAD09FB241D6748D808EA5

Function 006AC01F Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to copy local source path for pseudo bundle., xrefs: 006AC127
Failed to copy filename for pseudo bundle., xrefs: 006AC103
-%ls, xrefs: 006AC03C
Failed to copy version for pseudo bundle., xrefs: 006AC419
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 006AC330
Failed to copy display name for pseudo bundle., xrefs: 006AC43B
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 006AC0AA
Failed to copy cache id for pseudo bundle., xrefs: 006AC24B
Failed to append relation type to repair arguments for related bundle package, xrefs: 006AC2DD
Failed to append relation type to install arguments for related bundle package, xrefs: 006AC294
Failed to allocate memory for dependency providers., xrefs: 006AC3CA
Failed to copy key for pseudo bundle payload., xrefs: 006AC0DF
Failed to copy uninstall arguments for related bundle package, xrefs: 006AC30F
Failed to copy install arguments for related bundle package, xrefs: 006AC273
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 006AC065, 006AC09E, 006AC18D, 006AC3BE
Failed to copy key for pseudo bundle., xrefs: 006AC22C
Failed to copy repair arguments for related bundle package, xrefs: 006AC2BC
Failed to copy download source for pseudo bundle., xrefs: 006AC155
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 006AC071
Failed to allocate memory for pseudo bundle payload hash., xrefs: 006AC199

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-3959581252
Opcode ID: 23020ff5cec1ec47b90883d3d120a0c96142d22e16cbd9001b797ef35dacddc3
Instruction ID: f54a84e7afa58b123f709ec84ad0a3f517258787b1ca7e49e0e6c54c27f49021
Opcode Fuzzy Hash: 23020ff5cec1ec47b90883d3d120a0c96142d22e16cbd9001b797ef35dacddc3
Instruction Fuzzy Hash: BCC1D171A00616ABDB65AF68CC51E6A77DBFF0A720B01822AFC11EB341D771EC108F94

Function 00684639 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00684662
OpenProcessToken.ADVAPI32(00000000), ref: 00684669
GetLastError.KERNEL32 ref: 00684673
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 006846C3
GetLastError.KERNEL32 ref: 006846CD
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 00684711
GetLastError.KERNEL32 ref: 0068471B
Sleep.KERNEL32(000003E8), ref: 00684757
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00684768
GetLastError.KERNEL32 ref: 00684772
CloseHandle.KERNEL32(?), ref: 006847C8

Strings

Failed to get process token., xrefs: 006846A1
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00684697, 006846F1, 0068473F, 006847A9
Failed to schedule restart., xrefs: 006847B3
Failed to get shutdown privilege LUID., xrefs: 006846FB
SeShutdownPrivilege, xrefs: 006846B6
Failed to adjust token to add shutdown privileges., xrefs: 00684749

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 2241679041-3136258258
Opcode ID: 161778b10544dae6674a5f3903ecb29dcee63c3f24e85ec01ca5e2c632e4ef63
Instruction ID: 5780c30b29d3dc2bd56bde65602cc4d82be42980f8ff831a75d47087e8bea870
Opcode Fuzzy Hash: 161778b10544dae6674a5f3903ecb29dcee63c3f24e85ec01ca5e2c632e4ef63
Instruction Fuzzy Hash: 9141EF76A4023B7BE7206BE45D46FBF765BEB01B59F120229FE01BB240EB649C4087D5

Function 00694E6A Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 164pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00694E98
GetLastError.KERNEL32(?,00000000,?), ref: 00694EA1
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?), ref: 00694F43
GetLastError.KERNEL32 ref: 00694F50
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000), ref: 00694FCB
GetLastError.KERNEL32 ref: 00694FD6
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\burn\engine\pipe.cpp,00000132,00000000), ref: 00695016
LocalFree.KERNEL32(00000000), ref: 00695044

Strings

Failed to allocate full name of cache pipe: %ls, xrefs: 00694FAD
\\.\pipe\%ls, xrefs: 00694EF9
Failed to create the security descriptor for the connection event and pipe., xrefs: 00694ECF
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00694E93
Failed to create pipe: %ls, xrefs: 00694F81, 00695007
\\.\pipe\%ls.Cache, xrefs: 00694F97
Failed to allocate full name of pipe: %ls, xrefs: 00694F0F
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00694EC5, 00694F74, 00694FFA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1214480349-1710103387
Opcode ID: 2f74053c4bf98f9f81e6d7fb34a1d6b783f1b541cfb1133a949de9cf5531a8ac
Instruction ID: f9aced9c2e1254cbe1159c70918f87c711da8b9e6f49d8494b5f394f17845b85
Opcode Fuzzy Hash: 2f74053c4bf98f9f81e6d7fb34a1d6b783f1b541cfb1133a949de9cf5531a8ac
Instruction Fuzzy Hash: DE510772D40226BBDF215BA4CC46FEEBB6AAF04714F110125FD01BA390E7759E418BD5

Function 006BF340 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 172encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00000000,00000003,?,00699DDA,00000003,000007D0,?,000007D0), ref: 006BF3A5
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 006BF3AF
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?,?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0), ref: 006BF3EC
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 006BF3F6
CryptHashData.ADVAPI32(?,?,?,00000000,?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 006BF43D
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0), ref: 006BF461
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 006BF46B
CryptDestroyHash.ADVAPI32(00000000), ref: 006BF4A8
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 006BF4BF
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 006BF4D8
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0), ref: 006BF510
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 006BF51A
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001,?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0), ref: 006BF553
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 006BF561

Strings

c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 006BF48F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 3955742341-1443093764
Opcode ID: 93273d5cfbb86dabfc231416c9145f8e0f5bf9ddb236a6f83cd4c1aeb95e5acb
Instruction ID: 3952bb49992f1307286c6d27b7851a27b3127e00167766eb195267d510722cfe
Opcode Fuzzy Hash: 93273d5cfbb86dabfc231416c9145f8e0f5bf9ddb236a6f83cd4c1aeb95e5acb
Instruction Fuzzy Hash: E051DBB7E40239ABD7318B948D04BEB76A6BF04755F014075BE48F6261E7748DC08BE5

Function 00699D74 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00699EA1
Failed to reset permissions on unverified cached payload: %ls, xrefs: 00699EC7
Failed to get cached path for package with cache id: %ls, xrefs: 00699D9E
Failed to create unverified path., xrefs: 00699E44
copying, xrefs: 00699F06, 00699F0E
Failed to transfer working path to unverified path for payload: %ls., xrefs: 00699E7A
Failed to move verified file to complete payload path: %ls, xrefs: 00699F42
Failed to concat complete cached path., xrefs: 00699DCA
moving, xrefs: 00699EFF

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 98be89d9c56dbb481707d996230d8b17a790ae5174d93c210211ad5a938d8382
Instruction ID: 1ab23d44d0be960f50151f011105051d3efd29fd7437076a03aa94af2b57fd8f
Opcode Fuzzy Hash: 98be89d9c56dbb481707d996230d8b17a790ae5174d93c210211ad5a938d8382
Instruction Fuzzy Hash: 5A51B131D00519FBDF126BA8CD02FEDBB7BAF04740F104159F901B6661E7724E61ABA5

Function 006862CC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 0068631A
GetLastError.KERNEL32 ref: 00686324

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00686348
Failed to get OS info., xrefs: 00686352
Failed to set variant value., xrefs: 00686445

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 305913169-1157376746
Opcode ID: 6db6104d7dd307a2d6ba2879bff2e0ad35698708924f121ce2ccc1cb31ddbdff
Instruction ID: b1e2dda88ec497850eceb1f71872e8d483c981ec43d6b141e43153bde764d427
Opcode Fuzzy Hash: 6db6104d7dd307a2d6ba2879bff2e0ad35698708924f121ce2ccc1cb31ddbdff
Instruction Fuzzy Hash: CE411A71A00228ABDB20EB69DC4AFEFBFFAEB45714F104259F545E7240D670AE41CB90

Function 0068605F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0068608A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 0068609E
GetLastError.KERNEL32 ref: 006860B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00686104
GetLastError.KERNEL32 ref: 0068610E

Strings

Failed to get the required buffer length for the Date., xrefs: 006860D5
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 006860CB, 00686129
Failed to get the Date., xrefs: 00686133
Failed to allocate the buffer for the Date., xrefs: 006860EC
Failed to set variant value., xrefs: 0068614C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2700948981-3414009094
Opcode ID: 7b6a09da4f5632f12a6a19839ec34940ed2fcd949a5f29a25e0d58f8550758ba
Instruction ID: cc1c5e1779d3e208d9e91d30183026c2da5e784df9728286d1f0dbaa429c6b6c
Opcode Fuzzy Hash: 7b6a09da4f5632f12a6a19839ec34940ed2fcd949a5f29a25e0d58f8550758ba
Instruction Fuzzy Hash: C731CD72A402296BDB11B6E8CD4AFFFB76AAF04754F110129FB41F7281DA609D0087E5

Function 006BF79E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006EB5D4,00000000,?,?,?,?,006A1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 006BF7CC
GetCurrentProcessId.KERNEL32(00000000,?,006A1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 006BF7DC
GetCurrentThreadId.KERNEL32 ref: 006BF7E5
GetLocalTime.KERNEL32(8007139F,?,006A1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 006BF7FB
LeaveCriticalSection.KERNEL32(006EB5D4,006A1074,?,00000000,0000FDE9,?,006A1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 006BF8F2

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 006BF898
[n, xrefs: 006BF848
[n, xrefs: 006BF82B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$[n$[n
API String ID: 296830338-3174763274
Opcode ID: 08808d38894d2c511a96c810f397db6ef00131d768e3f006963a6db1dfe99218
Instruction ID: 6d36a560f4552acabd48ad97adc6281d491a0bfd74764b61b67d945190d328bd
Opcode Fuzzy Hash: 08808d38894d2c511a96c810f397db6ef00131d768e3f006963a6db1dfe99218
Instruction Fuzzy Hash: 4B4180B2D01219ABDB219FA5DC44AFFB7BBEB08705F141139F901A6270D7349D81CBA1

Function 00699A1D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,?,00000000,.unverified,?), ref: 00699ACC
lstrlenW.KERNEL32(?), ref: 00699AF3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00699B53
FindClose.KERNEL32(00000000), ref: 00699B5E

Strings

*.*, xrefs: 00699AA6
.unverified, xrefs: 00699A60

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrlen
String ID: *.*$.unverified
API String ID: 1108763488-2528915496
Opcode ID: 00a5d92da3584c8f7cea3e5818d100dcc4943a06412b061e11868940c431535c
Instruction ID: 09b138d39d1db788a3179c82e0ffd576bfc74cf4eea30800d646f2c7e9d8fd3b
Opcode Fuzzy Hash: 00a5d92da3584c8f7cea3e5818d100dcc4943a06412b061e11868940c431535c
Instruction Fuzzy Hash: 2C41713190062CAECF60AB64DD49BEEB7BEEF44315F1001A9E508E15A4E7749EC4DF28

Function 00686203 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00686233
GetLastError.KERNEL32 ref: 0068623D

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 0068625C
Failed to get the user name., xrefs: 00686266
Failed to set variant value., xrefs: 00686282

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2054405381-2744047247
Opcode ID: c2436586472af3b0c36d30282f49a48ccb8f5ae868cb658575098ed4ba1c7ec4
Instruction ID: 551677fc0ef26a881d6a35b43091fee3685dca3f5769af05da87e279cd0c89ed
Opcode Fuzzy Hash: c2436586472af3b0c36d30282f49a48ccb8f5ae868cb658575098ed4ba1c7ec4
Instruction Fuzzy Hash: 0F012672A0023867C710BB64DC56EFF77AAAF00754F110399F904E7241EA649E448B95

Function 006C8039 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000208,?), ref: 006C808E
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 006C80A0

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 006C80EB
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 006C8077

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ
API String ID: 1772835396-395410266
Opcode ID: bd81c5eaef7bdbae7850020e10ccc344d0594320c22b00f130f83c6931a5dc09
Instruction ID: 3a1e4b4ef2856565688550575e17be9154e9fb0924769bbcdeab3a70c1ab228d
Opcode Fuzzy Hash: bd81c5eaef7bdbae7850020e10ccc344d0594320c22b00f130f83c6931a5dc09
Instruction Fuzzy Hash: 652128A2900128AEDB60DBA9CC05FBBB3FDEB5C701F00445AB945E2080E638AA84D770

Function 00682078 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,?,?,00000000,?,00000000,?), ref: 006820A9
GetLastError.KERNEL32 ref: 006820B6
LocalFree.KERNEL32(00000000,?,?,00000000), ref: 006820FD

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 006820DA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-792799584
Opcode ID: 88f2f6034f7a4e352036ed0b544f13bb736444205f6354d09982711736e9c253
Instruction ID: 0b523a61cda2bfc2252214a30f1e0edaa7e4ccc7981cfe1a59c578d0293d50d1
Opcode Fuzzy Hash: 88f2f6034f7a4e352036ed0b544f13bb736444205f6354d09982711736e9c253
Instruction Fuzzy Hash: DC0161B690112AFBDB10ABD4DD09EDE7AADEB04754F014265BE01F7240E6749E40D7E4

Function 006A68EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,006A689A,00000000,00000003), ref: 006A6905
GetLastError.KERNEL32(?,006A689A,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,006A6C89,?), ref: 006A690F

Strings

c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 006A6933
Failed to set service start type., xrefs: 006A693D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp
API String ID: 1456623077-3535627199
Opcode ID: 43b0b205f0233748eec7b9f842824063c1aa3a42223ac6e6e66c3b3785314ad3
Instruction ID: 09f977cfe1668b81827a175b4c6ac50ce02dce50b6f2abff12f2a9727cca1db6
Opcode Fuzzy Hash: 43b0b205f0233748eec7b9f842824063c1aa3a42223ac6e6e66c3b3785314ad3
Instruction Fuzzy Hash: EBF0EC77A4513B33C72036E5AD05ECB7E4A9F12BB4B120315FE28BA3D0A5258C0086D4

Function 006B34A2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 006B359A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 006B35A4
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 006B35B1

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 46e31728907e310bc4741dd151989c70ea23abd6f3345c6dc3b1d2ca23a7c6d9
Instruction ID: e1580bc73f48d7c062f386c7185ab5aa0bc7ffc524da3742901628cf768f8c2d
Opcode Fuzzy Hash: 46e31728907e310bc4741dd151989c70ea23abd6f3345c6dc3b1d2ca23a7c6d9
Instruction Fuzzy Hash: 7531B57590122C9BCB61DF68D8897DCBBB5BF08310F5041EAE40CA7251E7709F858F45

Function 006B4104 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,006B40DA,00000000,006E7908,0000000C,006B4231,00000000,00000002,00000000), ref: 006B4125
TerminateProcess.KERNEL32(00000000,?,006B40DA,00000000,006E7908,0000000C,006B4231,00000000,00000002,00000000), ref: 006B412C
ExitProcess.KERNEL32 ref: 006B413E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a806510dd6dd7008a817d5f3328dd9453b825a2410d94cf8c9e32f8965c55553
Instruction ID: 36870fb2f1679ee190f6429095ae99fd175c62116717ce03a4e3cce2e867f29d
Opcode Fuzzy Hash: a806510dd6dd7008a817d5f3328dd9453b825a2410d94cf8c9e32f8965c55553
Instruction Fuzzy Hash: 2BE09271410248AFCF116FA8DD19AA83B6BAB51756F444014F9058B222CF399DC2CB85

Function 006B7437 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 006B7501

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: b3c4a8e8172440ccbdde2103f2de402584e74e43fa41171085664a68ed9b6fb9
Instruction ID: f7b3861165ea6bebf2a950dbd67932521497427b9d275de3250555bc2e1fa58d
Opcode Fuzzy Hash: b3c4a8e8172440ccbdde2103f2de402584e74e43fa41171085664a68ed9b6fb9
Instruction Fuzzy Hash: 4D4116B2904219AACB209FB8CC89DEB7BBAEBC4314F504568F905D7280E670DE81CB54

Function 006C32B9 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C3448: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,006C32E8,?), ref: 006C34B9

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 006C330C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006C331D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 7f8242a7d0976e593637b21996876e51595f2b947ef31997ccd1e846ac256788
Instruction ID: a006c09281b929c6e98b324bad20fa3aeb67ed1a39bed9db7ee92ea28286905c
Opcode Fuzzy Hash: 7f8242a7d0976e593637b21996876e51595f2b947ef31997ccd1e846ac256788
Instruction Fuzzy Hash: 221157B090026AEBDB00DFA4CD85BBEB7F9FF08308F50842EA505E6241D7709A448BA1

Function 006C3C72 Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(006A8F6B,?,00000001,00000000,00000000), ref: 006C3CAD
FindClose.KERNEL32(00000000), ref: 006C3CB9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 30cac7b0dfc3e0cb9e6b430d5e3bb78ee78bf70390c6697a41126342c4d054f5
Instruction ID: 7104901832eee7ad1a462bd2265ec36e4e69821ed48f07e866ed626a82fe8e27
Opcode Fuzzy Hash: 30cac7b0dfc3e0cb9e6b430d5e3bb78ee78bf70390c6697a41126342c4d054f5
Instruction Fuzzy Hash: FE01F9716002186BCB10FFA5DD89EAFB3AEEFC5319F004069F505D3380D6749E498B54

Function 0068FF35 Relevance: 84.5, APIs: 1, Strings: 47, Instructions: 482registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?,00020006,00000000), ref: 0069052B

Strings

URLUpdateInfo, xrefs: 00690265, 00690278
ParentKeyName, xrefs: 006902AB, 006902BE
Failed to create registration key., xrefs: 0068FFB8
Failed to cache bundle from path: %ls, xrefs: 0068FF8B
Failed to register the bundle dependency key., xrefs: 006904EC
3.11.2.4516, xrefs: 0069012C
SystemComponent, xrefs: 006903C1, 006903D4
Comments, xrefs: 006902D3, 006902E6
BundleCachePath, xrefs: 0068FFD8, 0068FFDD
"%ls" /uninstall /quiet, xrefs: 006903E1
EstimatedSize, xrefs: 006904B5, 006904BA, 006904C9
ParentDisplayName, xrefs: 0069028B, 0069029E
%hu.%hu.%hu.%hu, xrefs: 00690089
UninstallString, xrefs: 00690422, 00690438
Failed to update name and publisher., xrefs: 00690187
%s,0, xrefs: 00690159
BundleUpgradeCode, xrefs: 0068FFF3, 0068FFFB
QuietUninstallString, xrefs: 006903E6, 006903FC
DisplayIcon, xrefs: 00690154, 0069015E
"%ls" /modify, xrefs: 00690349
/uninstall, xrefs: 00690414, 00690419
NoModify, xrefs: 00690324, 00690337
BundleAddonCode, xrefs: 00690011, 00690019
DisplayVersion, xrefs: 0069019A, 006901AD
Failed to write update registration., xrefs: 0069047E
VersionMajor, xrefs: 006900A8, 006900AE
/modify, xrefs: 0069040D
Failed to update resume mode., xrefs: 00690506
NoRemove, xrefs: 0069039C, 006903AF
ModifyPath, xrefs: 0069034E, 00690364
"%ls" %ls, xrefs: 0069041D
BundleTag, xrefs: 00690114, 00690119
EngineVersion, xrefs: 00690136, 0069013B
Contact, xrefs: 006902FB, 0069030E
HelpLink, xrefs: 006901F3, 00690206
Publisher, xrefs: 006901CD, 006901E0
VersionMinor, xrefs: 006900D1, 006900D7
URLInfoAbout, xrefs: 0069023F, 00690252
BundleProviderKey, xrefs: 006900F3, 006900F8
%hs, xrefs: 00690131
BundlePatchCode, xrefs: 0069004D, 00690055
NoElevateOnModify, xrefs: 00690370, 00690383
Failed to write software tags., xrefs: 0069045E
HelpTelephone, xrefs: 00690219, 0069022C
Failed to write %ls value., xrefs: 006904CA
BundleDetectCode, xrefs: 0069002F, 00690037
BundleVersion, xrefs: 0069006B, 0069008E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.2.4516$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor
API String ID: 3535843008-666031719
Opcode ID: 11d5a8a891a3875f9f03f37943c4557713bd880abf221f3903aec3d0a5962faf
Instruction ID: 29c83f60405b0eba894db9421db5eb9a7bb613be0d627812be64124efa888333
Opcode Fuzzy Hash: 11d5a8a891a3875f9f03f37943c4557713bd880abf221f3903aec3d0a5962faf
Instruction Fuzzy Hash: 64F1B231941626FFFF626A60CD02FAD7AABEF04B14F114229FD00B6B51C761ED60A6D0

Function 0068CD76 Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,?,00000000,006CBB64,?,00000000), ref: 0068CEAC

Strings

Failed to get @FileSize., xrefs: 0068D162
Failed to get @SourcePath., xrefs: 0068D1A8
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 0068CDF8
external, xrefs: 0068CEDA
Failed to get @Container., xrefs: 0068D144
SourcePath, xrefs: 0068CF69
FileSize, xrefs: 0068CFBB
Failed to get @FilePath., xrefs: 0068D1D1
Failed to get @Packaging., xrefs: 0068D1CA
download, xrefs: 0068CE9E
LayoutOnly, xrefs: 0068CF46
Failed to get @LayoutOnly., xrefs: 0068D14E
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 0068D169
Failed to hex decode @CertificateRootThumbprint., xrefs: 0068D177
Failed to get @CertificateRootThumbprint., xrefs: 0068D17E
Catalog, xrefs: 0068D0A5
Failed to get payload node count., xrefs: 0068CDC9
Failed to allocate memory for payload structs., xrefs: 0068CE02
Failed to parse @FileSize., xrefs: 0068D158
FilePath, xrefs: 0068CE64
Failed to get @Hash., xrefs: 0068D19A
Payload, xrefs: 0068CD91
Failed to select payload nodes., xrefs: 0068CDA4
Container, xrefs: 0068CF04
Failed to get @Catalog., xrefs: 0068D18C
Failed to get @DownloadUrl., xrefs: 0068D1A1
Failed to get @Id., xrefs: 0068D1D8
CertificateRootPublicKeyIdentifier, xrefs: 0068CFF6
embedded, xrefs: 0068CEBE
CertificateRootThumbprint, xrefs: 0068D033
Hash, xrefs: 0068D070
Failed to to find container: %ls, xrefs: 0068D13D
Failed to find catalog., xrefs: 0068D185
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 0068D170
DownloadUrl, xrefs: 0068CF92
Failed to get next node., xrefs: 0068D1DF
Packaging, xrefs: 0068CE7F
Failed to hex decode the Payload/@Hash., xrefs: 0068D193
Invalid value for @Packaging: %ls, xrefs: 0068D1B7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\66\s\src\burn\engine\payload.cpp$download$embedded$external
API String ID: 1171520630-705547078
Opcode ID: fb0676abfc86b7730ed07bb5ef112cc6dc2e197e0345db3954f948a268f02b2b
Instruction ID: d22e91267c0f7d089301c74e27a5c59f6b5414680201641232f5cdfe49290dbc
Opcode Fuzzy Hash: fb0676abfc86b7730ed07bb5ef112cc6dc2e197e0345db3954f948a268f02b2b
Instruction Fuzzy Hash: 79C1AE7294122ABBDB11BA90CC49FBDBB77EF00724F110369E951BB2D0D771AE0197A4

Function 00688463 Relevance: 61.6, APIs: 5, Strings: 30, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,80070490,?,?,?,?,?,?,?,BTh,006ABEAE,?,?,?), ref: 00688494
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,BTh,006ABEAE,?,?,?,?,?,Chain), ref: 006887F7

Strings

version, xrefs: 00688619
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 006887AC
Initializing version variable '%ls' to value '%ls', xrefs: 00688640
BTh, xrefs: 00688463
Hidden, xrefs: 0068851C
Failed to find variable value '%ls'., xrefs: 006887C5
Initializing hidden variable '%ls', xrefs: 0068865E
Failed to select variable nodes., xrefs: 006884B1
Failed to set variant encryption, xrefs: 00688790
Persisted, xrefs: 00688537
Failed to get @Hidden., xrefs: 006887DB
Initializing numeric variable '%ls' to value '%ls', xrefs: 006885CF
string, xrefs: 006885E4
Failed to set variant value., xrefs: 00688778
Variable, xrefs: 0068849E
Failed to get @Id., xrefs: 006887E2
Failed to get @Persisted., xrefs: 006887D4
Initializing string variable '%ls' to value '%ls', xrefs: 00688607
Failed to get @Value., xrefs: 0068877F
Invalid value for @Type: %ls, xrefs: 0068875E
Failed to insert variable '%ls'., xrefs: 00688789
Value, xrefs: 00688552
numeric, xrefs: 006885A9
Failed to get @Type., xrefs: 00688771
Failed to change variant type., xrefs: 006887CD
Failed to get variable node count., xrefs: 006884CE
Failed to set value of variable: %ls, xrefs: 0068879A
Attempt to set built-in variable value: %ls, xrefs: 006887BB
Type, xrefs: 00688590
Failed to get next node., xrefs: 006887E9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$BTh$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\66\s\src\burn\engine\variable.cpp$numeric$string$version
API String ID: 3168844106-3740750591
Opcode ID: 163d7a924efd1c55f6f4d55da570e37ee01da6e0a254283f259729462f20aa94
Instruction ID: dcba645cbfe0bc67f559b116cdf00e864155272d8f62346d9222a4040ad8f28c
Opcode Fuzzy Hash: 163d7a924efd1c55f6f4d55da570e37ee01da6e0a254283f259729462f20aa94
Instruction Fuzzy Hash: A1B1AB72D00219BFCB11AB94CC46EEEBB7BEF44B10F650269F910B7291DB709E419B90

Function 006A6A2D Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 378COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,0069BC99,00000007,?,?,?), ref: 006A6A81

Part of subcall function 006C038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00685EE0,00000000), ref: 006C039E
Part of subcall function 006C038A: GetProcAddress.KERNEL32(00000000), ref: 006C03A5
Part of subcall function 006C038A: GetLastError.KERNEL32(?,?,?,00685EE0,00000000), ref: 006C03BC

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?), ref: 006A6E70
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?), ref: 006A6E84

Strings

Failed to append SysNative directory., xrefs: 006A6ADE
D, xrefs: 006A6C9C
"%ls" "%ls" /quiet /norestart, xrefs: 006A6BA9
SysNative\, xrefs: 006A6ACB
Failed to ensure WU service was enabled to install MSU package., xrefs: 006A6C8F
Failed to get process exit code., xrefs: 006A6D8D
Failed to get cached path for package: %ls, xrefs: 006A6B5D
Failed to wait for executable to complete: %ls, xrefs: 006A6DFF
Failed to append log path to MSU command-line., xrefs: 006A6C35
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 006A6CEE, 006A6D83, 006A6DAB
Failed to get action arguments for MSU package., xrefs: 006A6B37
Failed to format MSU uninstall command., xrefs: 006A6BEA
Failed to find System32 directory., xrefs: 006A6AF6
Failed to append log switch to MSU command-line., xrefs: 006A6C17
Failed to determine WOW64 status., xrefs: 006A6A93
Bootstrapper application aborted during MSU progress., xrefs: 006A6DB5
Failed to find Windows directory., xrefs: 006A6AC0
Failed to format MSU install command., xrefs: 006A6BBD
Failed to CreateProcess on path: %ls, xrefs: 006A6CFB
WixBundleExecutePackageCacheFolder, xrefs: 006A6B6C, 006A6E9C
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 006A6BD6
Failed to build MSU path., xrefs: 006A6B96
2, xrefs: 006A6D14
wusa.exe, xrefs: 006A6B01
/log:, xrefs: 006A6C03
Failed to allocate WUSA.exe path., xrefs: 006A6B14

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wusa.exe
API String ID: 1400713077-2603125353
Opcode ID: b0a7d6670f82ad8d96f5993c0d425d5f0268a49a504f484b6922f4b8f32d3720
Instruction ID: 15a150eb4c22cbd7cc75b326624d47abcab93a33d37a43bb2bcf446c9b7b4f0e
Opcode Fuzzy Hash: b0a7d6670f82ad8d96f5993c0d425d5f0268a49a504f484b6922f4b8f32d3720
Instruction Fuzzy Hash: 3AD1B171A0031AABDB11BFE4CD85EEEBABBAF05704F18412AF600B6251D7B59E41DF50

Function 006AD10E Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 006AD183
StringFromGUID2.OLE32(?,?,00000027), ref: 006AD1AC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 006AD295
GetLastError.KERNEL32(?,?,?,?), ref: 006AD29F
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 006AD338
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?), ref: 006AD343
ReleaseMutex.KERNEL32(?,?,?,?,?), ref: 006AD36D
GetExitCodeProcess.KERNEL32(?,?), ref: 006AD38E
GetLastError.KERNEL32(?,?,?,?), ref: 006AD39C
GetLastError.KERNEL32(?,?,?,?), ref: 006AD3D4

Part of subcall function 006AD016: WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,006AD312,?), ref: 006AD035
Part of subcall function 006AD016: ReleaseMutex.KERNEL32(?,?,?,006AD312,?), ref: 006AD049
Part of subcall function 006AD016: WaitForSingleObject.KERNEL32(?,000000FF), ref: 006AD08E
Part of subcall function 006AD016: ReleaseMutex.KERNEL32(?), ref: 006AD0A1
Part of subcall function 006AD016: SetEvent.KERNEL32(?), ref: 006AD0AA

CloseHandle.KERNEL32(00000000,?,?,?,?,?), ref: 006AD47D
CloseHandle.KERNEL32(00000000,?,?,?,?,?), ref: 006AD495

Strings

Failed to create netfx chainer guid., xrefs: 006AD190
Failed to allocate netfx chainer arguments., xrefs: 006AD263
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 006AD1C1, 006AD2C3, 006AD3C0, 006AD3F8
Failed to create netfx chainer., xrefs: 006AD22E
Failed to allocate event name., xrefs: 006AD20F
%ls /pipe %ls, xrefs: 006AD24F
!j, xrefs: 006AD13D
NetFxSection.%ls, xrefs: 006AD1D9
Failed to CreateProcess on path: %ls, xrefs: 006AD2CE
Failed to convert netfx chainer guid into string., xrefs: 006AD1CB
NetFxEvent.%ls, xrefs: 006AD1FB
Failed to wait for netfx chainer process to complete, xrefs: 006AD402
Failed to get netfx return code., xrefs: 006AD3CA
D, xrefs: 006AD27A
Failed to allocate section name., xrefs: 006AD1ED
Failed to process netfx chainer message., xrefs: 006AD318

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$!j
API String ID: 1533322865-1098360621
Opcode ID: e2f5bca9ce8ebac74aa433f2728daf6d59c7c0872dad12d5009a9418b1546106
Instruction ID: cea875e7958e163a2af576f56e7dd48c622004e49e0efeb97fab4313a6460a96
Opcode Fuzzy Hash: e2f5bca9ce8ebac74aa433f2728daf6d59c7c0872dad12d5009a9418b1546106
Instruction Fuzzy Hash: 7BA1C172D00228ABDB21ABA4CD45BAEB7BABF09310F114169ED0AFB251D7759D40CF91

Function 006C6C19 Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 006C6D2C
SysFreeString.OLEAUT32(00000000), ref: 006C6EF5
SysFreeString.OLEAUT32(00000000), ref: 006C6F92

Strings

link, xrefs: 006C6CC1, 006C6EA3
logo, xrefs: 006C6D7F
(, xrefs: 006C6ED0
generator, xrefs: 006C6D1F
author, xrefs: 006C6C6A, 006C6DFB
@, xrefs: 006C6E9B
`)u, xrefs: 006C6EF5, 006C6F92
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 006C6C46, 006C6F7C
entry, xrefs: 006C6CA4, 006C6E6D
title, xrefs: 006C6DB7
subtitle, xrefs: 006C6D9B
icon, xrefs: 006C6D43
category, xrefs: 006C6C87, 006C6E34
updated, xrefs: 006C6DD3

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`)u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-3067756321
Opcode ID: a13eb12a96c8154c2c77b667750ae3077bcb94530cb10d8c4fcbf4569f62db6d
Instruction ID: 4ef82ecf54ea387c5920ecff13751a9b316a9546f53a63eacd0caaf53c133a3b
Opcode Fuzzy Hash: a13eb12a96c8154c2c77b667750ae3077bcb94530cb10d8c4fcbf4569f62db6d
Instruction Fuzzy Hash: 8BB18E75A4521ABBCB119B94CC41FBEB6B6EF14720F20435DF521AA2D1DB70EA40CB98

Function 0068A3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0068A418
_MREFOpen@16.MSPDB140-MSVCRT ref: 0068A440
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?), ref: 0068A73F

Strings

Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0068A4E2
Failed to get expand environment string., xrefs: 0068A6AD
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 0068A510, 0068A545, 0068A598, 0068A6A1
Unsupported registry key value type. Type = '%u', xrefs: 0068A5D2
Failed to format value string., xrefs: 0068A44D
Failed to change value type., xrefs: 0068A6E3, 0068A706
Registry key not found. Key = '%ls', xrefs: 0068A478
Failed to clear variable., xrefs: 0068A49E
Failed to allocate string buffer., xrefs: 0068A633
Failed to query registry key value., xrefs: 0068A5A4
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 0068A717
Failed to format key string., xrefs: 0068A425
Failed to query registry key value size., xrefs: 0068A51C
Failed to read registry value., xrefs: 0068A6C8
Failed to set variable., xrefs: 0068A701
Failed to allocate memory registry value., xrefs: 0068A54F
Failed to open registry key., xrefs: 0068A4B3

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 2348241696-2754605460
Opcode ID: 1a4d2bae402451560425a19f332c6381010c445a24da67026445cbc089bb1d67
Instruction ID: 24ef4b952c9ddd66053487d5c68ee62cf932f0e07533161a5f24a142e88396a7
Opcode Fuzzy Hash: 1a4d2bae402451560425a19f332c6381010c445a24da67026445cbc089bb1d67
Instruction Fuzzy Hash: C5A1B576E00125ABEF11BAE4CC05FFE7ABBEB04710F15822AFD05BA250D6719D419792

Function 0069545D Relevance: 44.0, APIs: 17, Strings: 8, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(000000FF,?,00000000,?), ref: 0069547E
GetCurrentProcessId.KERNEL32 ref: 00695489
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000), ref: 006954C0
ConnectNamedPipe.KERNEL32(?,00000000), ref: 006954D5
GetLastError.KERNEL32 ref: 006954DF
Sleep.KERNEL32(00000064), ref: 00695514
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000), ref: 00695537
WriteFile.KERNEL32(?,?,00000004,00000000,00000000), ref: 00695552
WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 0069556D
WriteFile.KERNEL32(?,?,00000004,00000000,00000000), ref: 00695588
ReadFile.KERNEL32(?,?,00000004,00000000,00000000), ref: 006955A3
GetLastError.KERNEL32 ref: 006955FE
GetLastError.KERNEL32 ref: 00695632
GetLastError.KERNEL32 ref: 00695666
GetLastError.KERNEL32 ref: 0069569A
GetLastError.KERNEL32 ref: 006956CB
GetLastError.KERNEL32 ref: 006956FC

Strings

Failed to write secret to pipe., xrefs: 00695690
Failed to set pipe to non-blocking., xrefs: 00695726
Failed to reset pipe to blocking., xrefs: 006956F5
Failed to write our process id to pipe., xrefs: 0069565C
Failed to read ACK from pipe., xrefs: 00695628
Failed to write secret length to pipe., xrefs: 006956C4
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 006955EA, 0069561E, 00695652, 00695686, 006956BA, 006956EB, 0069571C
Failed to wait for child to connect to pipe., xrefs: 006955F4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 2944378912-2940396456
Opcode ID: 02f4ec858ceed0ee0396d34fef9e2f43cd293aa889678ab9a9c92b9d4de4dd35
Instruction ID: e4b49eb6da8b84a1a9ab25474403f266eb9c82ecb6f4b967a4287be5b661f821
Opcode Fuzzy Hash: 02f4ec858ceed0ee0396d34fef9e2f43cd293aa889678ab9a9c92b9d4de4dd35
Instruction Fuzzy Hash: B361C8B3D41635ABDB219AA48D45FEEA6AE6F00B50F120125FD02FF790D674DE0087E6

Function 006857A7 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,0068A889,00000100,000000B8,000002C0,00000100), ref: 006857CC
lstrlenW.KERNEL32(000002C0,?,0068A889,00000100,000000B8,000002C0,00000100), ref: 006857D6
_wcschr.LIBVCRUNTIME ref: 006859DB
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,0068A889,00000100,000000B8,000002C0,00000100), ref: 00685C7E

Strings

Failed to set record format string., xrefs: 00685B08
Failed to allocate variable array., xrefs: 00685AB9
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00685A32, 00685A53, 00685AAC, 00685AFE, 00685B8A, 00685BBC, 00685C38
Failed to append placeholder., xrefs: 00685A81
Failed to copy string., xrefs: 00685C62
Failed to reallocate variable array., xrefs: 00685A60
Failed to format record., xrefs: 00685C42
Failed to set variable value., xrefs: 00685A95
*****, xrefs: 0068594D
[%d], xrefs: 00685996
Failed to allocate record., xrefs: 00685A3F
Failed to format placeholder string., xrefs: 00685A8B
Failed to get variable name., xrefs: 00685AC0
Failed to determine variable visibility: '%ls'., xrefs: 00685A6E
Failed to set record string., xrefs: 00685B94
Failed to allocate buffer for format string., xrefs: 006857F4
Failed to get formatted length., xrefs: 00685BC6
Failed to allocate string., xrefs: 00685BF5
Failed to append string., xrefs: 00685852

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1026845265-1173883696
Opcode ID: 66bfd7f00a59e4c33ae255f91ffb47695de7c32a8252e5575750a6bc0e66a287
Instruction ID: 024c9e85935dfea26fe70cb10b2c6a94ca161de441eca5166a25f60ef3584af3
Opcode Fuzzy Hash: 66bfd7f00a59e4c33ae255f91ffb47695de7c32a8252e5575750a6bc0e66a287
Instruction Fuzzy Hash: 4AF17571D00625AFDB10BFA48841EFF7BB7EB44B50F15822EF916AB240D7749A018FA4

Function 006ACB5D Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 239synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,006AD228,?,?,?), ref: 006ACBA3
GetLastError.KERNEL32(?,?,006AD228,?,?,?), ref: 006ACBB0
ReleaseMutex.KERNEL32(?), ref: 006ACE18

Strings

failed to allocate memory for event name, xrefs: 006ACBF6
Failed to create mutex: %ls, xrefs: 006ACCB2
Failed to MapViewOfFile for %ls., xrefs: 006ACD4C
Failed to allocate memory for NetFxChainer struct., xrefs: 006ACB89
failed to copy event name to shared memory structure., xrefs: 006ACD76
Failed to create event: %ls, xrefs: 006ACC43
Failed to memory map cabinet file: %ls, xrefs: 006ACD04
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 006ACB7F, 006ACBD1, 006ACC36, 006ACCA5, 006ACCF7, 006ACD3F
%ls_send, xrefs: 006ACBE2
failed to allocate memory for mutex name, xrefs: 006ACC65
%ls_mutex, xrefs: 006ACC51

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2874813099
Opcode ID: 41755f6e5515e9c843912e7f10f7425388eac3cba03a1bc4b5c702aca9796296
Instruction ID: 55654abb0eb4bd0d017645791606d74e67a159fde592c9aa68aadf06debb08ae
Opcode Fuzzy Hash: 41755f6e5515e9c843912e7f10f7425388eac3cba03a1bc4b5c702aca9796296
Instruction Fuzzy Hash: 358106B2A40736BBC321AB648C49F96BEA6BF05730F064265FD09AB351D775DD00CAE4

Function 006C68DE Relevance: 38.8, APIs: 11, Strings: 11, Instructions: 297COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,006E6470,000000FF,?,?,?), ref: 006C69A5
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 006C69CA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 006C69EA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 006C6A06
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 006C6A2E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 006C6A4A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 006C6A83
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 006C6ABC

Part of subcall function 006C6527: SysFreeString.OLEAUT32(00000000), ref: 006C6660
Part of subcall function 006C6527: SysFreeString.OLEAUT32(00000000), ref: 006C669F

SysFreeString.OLEAUT32(00000000), ref: 006C6B40
SysFreeString.OLEAUT32(00000000), ref: 006C6BF0

Strings

link, xrefs: 006C6943, 006C6AEE
published, xrefs: 006C69F8
summary, xrefs: 006C69BC
(, xrefs: 006C6B1B
title, xrefs: 006C69DC
content, xrefs: 006C6AAE
category, xrefs: 006C6926, 006C6A75
updated, xrefs: 006C6A20
author, xrefs: 006C6909, 006C6A3C
`)u, xrefs: 006C6B40, 006C6BF0
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 006C6BDD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`)u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$category$content$link$published$summary$title$updated
API String ID: 318886736-3151670256
Opcode ID: d2569fcd778ea8469a753f3be96bb1db5c033f740212aa1f2c6263bd4b285be8
Instruction ID: ade2ca0c31991bc7dcb839397ee5df37a9ded121f726816bfeff2cd782fe53c3
Opcode Fuzzy Hash: d2569fcd778ea8469a753f3be96bb1db5c033f740212aa1f2c6263bd4b285be8
Instruction Fuzzy Hash: 24A18F7190522ABBCB219B94CC41FBD77A6EF14720F204369F521EA2D1C770EE60DB98

Function 006A2596 Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

UninstallArguments, xrefs: 006A25F2
Failed to parse exit codes., xrefs: 006A26A6
Failed to get @InstallArguments., xrefs: 006A25E1
burn, xrefs: 006A267A
Failed to parse command lines., xrefs: 006A2722
Failed to get @Repairable., xrefs: 006A264F
Failed to get @RepairArguments., xrefs: 006A2625
Failed to get @DetectCondition., xrefs: 006A25BF
DetectCondition, xrefs: 006A25AE
Failed to get @UninstallArguments., xrefs: 006A2603
Invalid protocol type: %ls, xrefs: 006A26F6
RepairArguments, xrefs: 006A2614
Failed to get @Protocol., xrefs: 006A270E
Repairable, xrefs: 006A2636
netfx4, xrefs: 006A26AF
Protocol, xrefs: 006A265D
InstallArguments, xrefs: 006A25D0
none, xrefs: 006A26D0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: e113b0e43589a28ddee897b62608ef7a08d5f441a4b7fd5676b2bc738edecf83
Instruction ID: 150dd2247de29edc7dba03b30637423f1adce310a4b7723bdaaf87b23be4ce4b
Opcode Fuzzy Hash: e113b0e43589a28ddee897b62608ef7a08d5f441a4b7fd5676b2bc738edecf83
Instruction Fuzzy Hash: 84410BB1EC9323B7C71176A88D62F6A765B9B02B30F220316F924F63C1C664DE014B96

Function 00688F3F Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,56006CCC,00000001,?,0068990B,000002C0,00000100,00000000,?,?,006898F3,?,000000B8,00000100,00000000), ref: 00688F7D

Strings

AND, xrefs: 00689289
NOT, xrefs: 006892A8
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00689065
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 0068934D
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 00689051, 0068911B, 00689197, 006891FB, 00689339, 0068937D, 006893C1
-, xrefs: 006890E5
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 006891AB
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 0068920F
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 0068912F
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00689391
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 006893D5
Failed to set symbol value., xrefs: 0068902D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 4177115715-1494984065
Opcode ID: 0a41b0d29e4f12971b5b9575798e180ef2587f355f7a91c7b2b6ec5981c4ead5
Instruction ID: c054b732d73dbd3527a7854243b07e4bb5e7b01bdb617bdde2fbd5843ce28a13
Opcode Fuzzy Hash: 0a41b0d29e4f12971b5b9575798e180ef2587f355f7a91c7b2b6ec5981c4ead5
Instruction Fuzzy Hash: 37F1E0B1500205EBDB14EF94C899BFA7BA7FB05704F188319F9059A785C3B5DA92CBA0

Function 0068E9FC Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 006C2B5D: VariantInit.OLEAUT32(?), ref: 006C2B73
Part of subcall function 006C2B5D: SysAllocString.OLEAUT32(?), ref: 006C2B8F
Part of subcall function 006C2B5D: VariantClear.OLEAUT32(?), ref: 006C2C16
Part of subcall function 006C2B5D: SysFreeString.OLEAUT32(00000000), ref: 006C2C21

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,006CBB64,?,?,Action,?,?,?,00000000,?), ref: 0068EACD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 0068EB17

Strings

Failed to get RelatedBundle nodes, xrefs: 0068EA2C
Failed to get @Id., xrefs: 0068EC1C
Failed to get next RelatedBundle element., xrefs: 0068EC2A
Failed to resize Detect code array in registration, xrefs: 0068EBE8
Addon, xrefs: 0068EB54
Action, xrefs: 0068EA8A
RelatedBundle, xrefs: 0068EA0A
Failed to get RelatedBundle element count., xrefs: 0068EA51
Upgrade, xrefs: 0068EB0A
Invalid value for @Action: %ls, xrefs: 0068EC0C
Failed to resize Patch code array in registration, xrefs: 0068EBFD
Failed to resize Upgrade code array in registration, xrefs: 0068EBEF
Patch, xrefs: 0068EB97
Detect, xrefs: 0068EABE
Failed to get @Action., xrefs: 0068EC23
Failed to resize Addon code array in registration, xrefs: 0068EBF6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade
API String ID: 702752599-3660206225
Opcode ID: 73d4d564d9e4f7cab5f5acca89e1ff4b29c77bcb24ad54b9ea034248b18f5d35
Instruction ID: 296ec7edc847f62728e22020e821b6d2a5d57a7c1727bcc45ae09eb266c331d0
Opcode Fuzzy Hash: 73d4d564d9e4f7cab5f5acca89e1ff4b29c77bcb24ad54b9ea034248b18f5d35
Instruction Fuzzy Hash: 4D71B135E4462ABBCB10AF50CD41EAEB7B6FB05724F214359F921AB780D771AE41CB90

Function 006A1951 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 006A1A58
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 006A1A76

Strings

success, xrefs: 006A1A49
Invalid exit code type: %ls, xrefs: 006A1B47
Failed to get exit code node count., xrefs: 006A19A3
ExitCode, xrefs: 006A195F
Failed to get @Code., xrefs: 006A1B38
scheduleReboot, xrefs: 006A1A85
Failed to select exit code nodes., xrefs: 006A197E
error, xrefs: 006A1A69
Failed to get @Type., xrefs: 006A1B57
forceReboot, xrefs: 006A1AA3
c:\agent\_work\66\s\src\burn\engine\exeengine.cpp, xrefs: 006A19D9
Failed to allocate memory for exit code structs., xrefs: 006A19E3
Type, xrefs: 006A1A30
Failed to parse @Code value: %ls, xrefs: 006A1B31
Code, xrefs: 006A1AC5
Failed to get next node., xrefs: 006A1B5E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$c:\agent\_work\66\s\src\burn\engine\exeengine.cpp$error$forceReboot$scheduleReboot$success
API String ID: 2664528157-2974551199
Opcode ID: 6b7ff1afd391d39b036a07eca71acf258e7f871d8a79fa9e63ef4b1843536c8b
Instruction ID: 50df60c3a2acbec23863ed33b574435648939503e759c6fa0a2e4c461215ce46
Opcode Fuzzy Hash: 6b7ff1afd391d39b036a07eca71acf258e7f871d8a79fa9e63ef4b1843536c8b
Instruction Fuzzy Hash: 8161B235E0521ABBCB10AB94CC51EAEBBA7EF43720F214259F424AF3D0D6709E01DB95

Function 00694668 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,?,?,00694B7B,00000000,00000000,?,00000000), ref: 0069467F
ReadFile.KERNEL32(?,?,00000004,00000000,00000000,?,00694B7B,00000000,00000000,?,00000000), ref: 006946A0
GetLastError.KERNEL32(?,00694B7B,00000000,00000000,?,00000000), ref: 006946A6
ReadFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00694B7B,00000000,00000000,?,00000000), ref: 00694734
GetLastError.KERNEL32(?,00694B7B,00000000,00000000,?,00000000), ref: 0069473A

Strings

Failed to allocate buffer for verification secret., xrefs: 0069471D
Failed to read size of verification secret from parent pipe., xrefs: 006946D4
Verification secret from parent does not match., xrefs: 006947A2
Verification secret from parent is too big., xrefs: 00694701
Failed to read verification process id from parent pipe., xrefs: 006947ED
Failed to read verification secret from parent pipe., xrefs: 00694768
Failed to inform parent process that child is running., xrefs: 00694847
{Ki, xrefs: 00694804, 00694807
Verification process id from parent does not match., xrefs: 00694887
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 006946CA, 006946F5, 0069475E, 00694796, 006947E3, 0069483D, 0069487B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp${Ki
API String ID: 1233551569-15104916
Opcode ID: de77775f18a1496b9df4aa6837124c8bd3e760a122ed4cb5a993e5d11de9c6f4
Instruction ID: e505d31ba75581769611ebaf33380b73a1f0c1e61516e0702ceab89c7576f9ff
Opcode Fuzzy Hash: de77775f18a1496b9df4aa6837124c8bd3e760a122ed4cb5a993e5d11de9c6f4
Instruction Fuzzy Hash: 1151B976D4023AB7DB2196D44D45FAE766EAF01B50F12012AFE10BF780DB74DE0187A6

Function 006C78F7 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 308COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,000002C0), ref: 006C7924
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 006C793F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 006C79E2
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF,00000018,00000000,00000000), ref: 006C7A21
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 006C7A74
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,true,000000FF), ref: 006C7A92
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 006C7ACA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 006C7C0E

Strings

version, xrefs: 006C7A13, 006C7ABC
enclosure, xrefs: 006C7BFC
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 006C7B31
true, xrefs: 006C7A84
http://appsyndication.org/2006/appsyn, xrefs: 006C7917
upgrade, xrefs: 006C79D4
exclusive, xrefs: 006C7A66
type, xrefs: 006C796A
application, xrefs: 006C7931

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3624447555
Opcode ID: aae499136bb5bf259ffb1fc63531dd1109a8d7f2319e39e3ae6d1aeb708baac0
Instruction ID: af1a98cdbd908870a4376d141207069e5a8d1b3baf6d4627263a8e4a77de4f7e
Opcode Fuzzy Hash: aae499136bb5bf259ffb1fc63531dd1109a8d7f2319e39e3ae6d1aeb708baac0
Instruction Fuzzy Hash: C9B19A31648206AFDB609F58CC81FAA77A7FB44720F218658F925EB2D5DB70E901CF00

Function 0069E226 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0069E10F: LoadBitmapW.USER32(?,00000001), ref: 0069E145
Part of subcall function 0069E10F: GetLastError.KERNEL32 ref: 0069E151

LoadCursorW.USER32(00000000,00007F00), ref: 0069E287
RegisterClassW.USER32(?), ref: 0069E29B
GetLastError.KERNEL32 ref: 0069E2A6
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 0069E3AB
DeleteObject.GDI32(00000000), ref: 0069E3BA

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 0069E2CA, 0069E333
WixBurnSplashScreen, xrefs: 0069E294, 0069E3A6
Failed to create window., xrefs: 0069E33D
Failed to load splash screen., xrefs: 0069E25F
Unexpected return value from message pump., xrefs: 0069E395
Failed to register window., xrefs: 0069E2D4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 164797020-1158544062
Opcode ID: 028179de9bec1467495beb50b2edd46b83917b37a9e5ef7477fa9dd2b2d73ce8
Instruction ID: dd8b9370b85cdaab0f6c796cb1dfe980d39821ad7fdf6ac48d5da2c810c33a8a
Opcode Fuzzy Hash: 028179de9bec1467495beb50b2edd46b83917b37a9e5ef7477fa9dd2b2d73ce8
Instruction Fuzzy Hash: 9B41BF76900629BFDF119BE4DD09EAEBB7FBF04714B100129FA00E7650D7369D0087A1

Function 00696AC2 Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 355synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0068D461: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00696F37,000000B8,00000000), ref: 0068D470
Part of subcall function 0068D461: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0068D47F
Part of subcall function 0068D461: LeaveCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00696F37,000000B8,00000000), ref: 0068D494

ReleaseMutex.KERNEL32(00000000,?,00000000,?,?,00000001,00000000), ref: 00696E86
CloseHandle.KERNEL32(00000000), ref: 00696E8F
CloseHandle.KERNEL32(?,?,00000000,?,?,00000001,00000000), ref: 00696EAF

Part of subcall function 006AB9F8: SetThreadExecutionState.KERNEL32(80000001), ref: 006AB9FD

Strings

Failed while caching, aborting execution., xrefs: 00696D8D
Failed to set initial apply variables., xrefs: 00696BFE
Engine cannot start apply because it is busy with another action., xrefs: 00696B23
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 00696B8A, 00696D5B
Another per-user setup is already executing., xrefs: 00696BD4
UX aborted apply begin., xrefs: 00696B94
Failed to cache engine to working directory., xrefs: 00696C68
Failed to elevate., xrefs: 00696C8E
Failed to register bundle., xrefs: 00696CEB
Another per-machine setup is already executing., xrefs: 00696CC8
Failed to create cache thread., xrefs: 00696D65

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeExecutionInterlockedLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 1740103319-2508447769
Opcode ID: 6178609ab06118ea4d680e2eaeedeaab69698dea73109a76b5fbcb74742c6c95
Instruction ID: de40618ccce35c578fc292a208ee5f37ac629d03d56909c725bcbeba480dc333
Opcode Fuzzy Hash: 6178609ab06118ea4d680e2eaeedeaab69698dea73109a76b5fbcb74742c6c95
Instruction Fuzzy Hash: 62C19EB1901315EBDF559FA0C885EEE3BAEAF04314F04417AFD05AA646EB309D45CBA8

Function 006A9B0F Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 232threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,?,00000000,00000000,?,?,?), ref: 006A9B74
GetLastError.KERNEL32 ref: 006A9CE4
GetExitCodeThread.KERNEL32(?,00000000), ref: 006A9D24
GetLastError.KERNEL32 ref: 006A9D2E

Strings

Failed to execute MSI package., xrefs: 006A9BD4
Failed to get cache thread exit code., xrefs: 006A9D5F
Failed to execute package provider registration action., xrefs: 006A9C45
Failed to wait for cache check-point., xrefs: 006A9D15
Failed to execute dependency action., xrefs: 006A9C64
Cache thread exited unexpectedly., xrefs: 006A9D75
Failed to execute EXE package., xrefs: 006A9BAB
Failed to load compatible package on per-machine package., xrefs: 006A9C8A
Failed to execute MSP package., xrefs: 006A9BF9
Failed to execute MSU package., xrefs: 006A9C29
Failed to execute compatible package action., xrefs: 006A9CA1
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 006A9D0B, 006A9D55
Invalid execute action., xrefs: 006A9D84

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$c:\agent\_work\66\s\src\burn\engine\apply.cpp
API String ID: 3703294532-2335230991
Opcode ID: 1b4971cd674ca6571e8b846252fafbeca48b9a5c408851abd1651d0935428030
Instruction ID: e27f10e821f42f29b396fae440742a55fb0e0ceda27adc98ccdad331c2946f8b
Opcode Fuzzy Hash: 1b4971cd674ca6571e8b846252fafbeca48b9a5c408851abd1651d0935428030
Instruction Fuzzy Hash: 56715B71E01629EBDB11EFA48941EAE7BBAAF46710F21415AF805EB341D2709E019BB0

Function 0068F1BA Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C3349: GetVersionExW.KERNEL32(?,?,00000000,00000000), ref: 006C3398

RegCloseKey.ADVAPI32(00000000,?,006CFF38,00020006,?,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0068F3EA

Part of subcall function 006C0D39: RegSetValueExW.ADVAPI32(00000000,00000005,00000000,00000004,?,00000004,?,?,0068F237,006CFF38,Resume,00000005,00000000,00000000,00000000,00000000), ref: 006C0D4E

Strings

Failed to write resume command line value., xrefs: 0068F307
Installed, xrefs: 0068F24F
Failed to write run key value., xrefs: 0068F2E5
burn.runonce, xrefs: 0068F284
"%ls" /%ls, xrefs: 0068F28F
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0068F36E, 0068F3BC
Failed to delete resume command line value., xrefs: 0068F3C6
Failed to delete run key value., xrefs: 0068F378
Failed to create run key., xrefs: 0068F2C7
BundleResumeCommandLine, xrefs: 0068F2F2, 0068F385
Failed to write Installed value., xrefs: 0068F260
Resume, xrefs: 0068F22C
Failed to format resume command line for RunOnce., xrefs: 0068F2A3
Failed to write Resume value., xrefs: 0068F23D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 2348918689-1350441746
Opcode ID: 0df10b79b14ce9842112eaac0c70f400bfff01465144415e5dc96ae751efbb82
Instruction ID: a89c78e1248a11d5db7f9a501d385fd8f7ae63fb9d812bb4d61e1b117bfe0cf9
Opcode Fuzzy Hash: 0df10b79b14ce9842112eaac0c70f400bfff01465144415e5dc96ae751efbb82
Instruction Fuzzy Hash: 0B51B172D40226FBEF21BBE08C06FAEBA67EF04714F15067AF901B6291D7749A5097D0

Function 006AC96F Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(75918FB0,00000000,00000000), ref: 006AC97B

Part of subcall function 00694D1A: UuidCreate.RPCRT4(?), ref: 00694D4D

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,006A219D,?,?,00000000,?,?,?), ref: 006ACA59
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 006ACA63
GetProcessId.KERNEL32(006A219D,?,?,00000000,?,?,?,?), ref: 006ACA9B

Part of subcall function 0069545D: lstrlenW.KERNEL32(000000FF,?,00000000,?), ref: 0069547E
Part of subcall function 0069545D: GetCurrentProcessId.KERNEL32 ref: 00695489
Part of subcall function 0069545D: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000), ref: 006954C0
Part of subcall function 0069545D: ConnectNamedPipe.KERNEL32(?,00000000), ref: 006954D5
Part of subcall function 0069545D: GetLastError.KERNEL32 ref: 006954DF
Part of subcall function 0069545D: Sleep.KERNEL32(00000064), ref: 00695514
Part of subcall function 0069545D: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000), ref: 00695537
Part of subcall function 0069545D: WriteFile.KERNEL32(?,?,00000004,00000000,00000000), ref: 00695552
Part of subcall function 0069545D: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 0069556D
Part of subcall function 0069545D: WriteFile.KERNEL32(?,?,00000004,00000000,00000000), ref: 00695588

Part of subcall function 006C02EC: WaitForSingleObject.KERNEL32(000001F4,?,00000000,?,006A2302,?,000001F4,?,?,?,?,?,?,?,?), ref: 006C02F8
Part of subcall function 006C02EC: GetLastError.KERNEL32(?,006A2302,?,000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0306

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006AC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 006ACB1F
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006AC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 006ACB2E
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006AC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 006ACB45

Strings

Failed to wait for embedded executable: %ls, xrefs: 006ACB02
burn.embedded, xrefs: 006ACA16
Failed to allocate embedded command., xrefs: 006ACA32
Failed to process messages from embedded message., xrefs: 006ACAE2
Failed to wait for embedded process to connect to pipe., xrefs: 006ACABD
Failed to create embedded pipe., xrefs: 006ACA05
Failed to create embedded pipe name and client token., xrefs: 006AC9DE
%ls -%ls %ls %ls %u, xrefs: 006ACA1E
c:\agent\_work\66\s\src\burn\engine\embedded.cpp, xrefs: 006ACA84
Failed to create embedded process at path: %ls, xrefs: 006ACA91

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$c:\agent\_work\66\s\src\burn\engine\embedded.cpp
API String ID: 875070380-1877421928
Opcode ID: f3edd7167d9324d2a0a32444de537f29f2b5ff4448ff71da6a532007df5c9cbd
Instruction ID: 4704745d9d1fd607ec1707369df27ca913cdfe48ca7644d19a9395095fd7d3d9
Opcode Fuzzy Hash: f3edd7167d9324d2a0a32444de537f29f2b5ff4448ff71da6a532007df5c9cbd
Instruction Fuzzy Hash: FB517272D40229BBDF11EBA4DC02FEEBABAAB05720F110126FA01B6250D6759E418B95

Function 0068EC76 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0068EE04

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

SysFreeString.OLEAUT32(?), ref: 0068EDBC

Strings

SoftwareTag, xrefs: 0068EC85
Regid, xrefs: 0068ED52
Filename, xrefs: 0068ED37
Failed to allocate memory for software tag structs., xrefs: 0068ED03
Failed to select software tag nodes., xrefs: 0068ECA6
Failed to get @Regid., xrefs: 0068EE55
Failed to get @Path., xrefs: 0068EE4B
Path, xrefs: 0068ED6A
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0068ECF9
`)u, xrefs: 0068EDBC, 0068EE04
Failed to get @Filename., xrefs: 0068EE5F
Failed to get SoftwareTag text., xrefs: 0068EE41
Failed to convert SoftwareTag text to UTF-8, xrefs: 0068EE37
Failed to get next node., xrefs: 0068EE69
Failed to get software tag count., xrefs: 0068ECCB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`)u$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 336948655-1776243743
Opcode ID: 62fdd541cdbb4bbe04d9e0baae63adb3f909e6c40f084a3473065e014856d38c
Instruction ID: 696352ed33b7f75ff7faa530be97a86e161bdefadc7f779556bd80675592aec4
Opcode Fuzzy Hash: 62fdd541cdbb4bbe04d9e0baae63adb3f909e6c40f084a3473065e014856d38c
Instruction Fuzzy Hash: 8F51A071E4021AEBDB11AF54C895EAEBBAAEF04B00F11426DF815AB350C772DE008B94

Function 00689FFE Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 214COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0068A076

Strings

Failed to format GUID string., xrefs: 0068A081
Product or related product not found: %ls, xrefs: 0068A161
Language, xrefs: 0068A05F
Failed to get product info., xrefs: 0068A1A3
State, xrefs: 0068A058
VersionString, xrefs: 0068A066, 0068A0F1, 0068A107, 0068A11B, 0068A134, 0068A148
Failed to enumerate related products for upgrade code., xrefs: 0068A0B1
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 0068A108
Failed to change value type., xrefs: 0068A1DD
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 0068A135
Unsupported product search type: %u, xrefs: 0068A03E
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 0068A20F
AssignmentType, xrefs: 0068A051
Failed to copy upgrade code., xrefs: 0068A0D6
Failed to set variable., xrefs: 0068A1FC

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 9b88ddd1656ea0d01d7c17aff3518cb00af0b19d5b6465eaf333e3a8357a5097
Instruction ID: 79453470ff43c62660da5f6a84aadbd9d3ade6d7a2c1f69976a631aeef603052
Opcode Fuzzy Hash: 9b88ddd1656ea0d01d7c17aff3518cb00af0b19d5b6465eaf333e3a8357a5097
Instruction Fuzzy Hash: 4461F572D40115BBEB21BAD8CD59EEE7B6BEB05704F24426AFD00BB251D232DF409792

Function 006C7741 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,?,006C7C2B,00000001,?), ref: 006C7761
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,00000000,000000FF,?,006C7C2B,00000001,?), ref: 006C777C
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,00000000,000000FF,?,006C7C2B,00000001,?), ref: 006C7797
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,00000000,000000FF,?,006C7C2B,00000001,?), ref: 006C7803
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,00000000,000000FF,?,006C7C2B,00000001,?), ref: 006C7827
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,00000000,000000FF,?,006C7C2B,00000001,?), ref: 006C784B
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,00000000,000000FF,?,006C7C2B,00000001,?), ref: 006C786B
lstrlenW.KERNEL32(00000000,?,006C7C2B,00000001,?), ref: 006C7886

Strings

sha1, xrefs: 006C7842
name, xrefs: 006C778E
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 006C789E
md5, xrefs: 006C781E
http://appsyndication.org/2006/appsyn, xrefs: 006C7754
algorithm, xrefs: 006C77FA
sha256, xrefs: 006C7862
digest, xrefs: 006C7773

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$name$sha1$sha256
API String ID: 1657112622-2127483976
Opcode ID: 947759e141c68af8722c9df2bc9890f3eba17b4a66565fd9ceb291ac3139adf8
Instruction ID: 0b6a0e61287179ef08b1e0f5814073f211a37324d4d6f2e8d0bf65ea5a393956
Opcode Fuzzy Hash: 947759e141c68af8722c9df2bc9890f3eba17b4a66565fd9ceb291ac3139adf8
Instruction Fuzzy Hash: 5551A031649716BBDB205F55CC86F757A63EB11B30F204328FA35AA2E5C7A4E850CBA1

Function 0068F52B Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00690478,InstallerVersion,InstallerVersion,00000000,00690478,InstallerName,InstallerName,00000000,00690478,Date,InstalledDate,00000000,00690478,LogonUser), ref: 0068F6D9

Part of subcall function 006C0D87: RegSetValueExW.ADVAPI32(00020006,006CFF38,00000000,00000001,?,?,?,000000FF,?,00000000,?,?,0068F2DF,?,?,00020006), ref: 006C0DBA

Strings

PublishingGroup, xrefs: 0068F60D, 0068F620
ThisVersionInstalled, xrefs: 0068F585, 0068F598
ReleaseType, xrefs: 0068F630, 0068F635, 0068F644
Publisher, xrefs: 0068F5E5, 0068F5F8
InstallerName, xrefs: 0068F68A, 0068F68F, 0068F690, 0068F6A0
PackageVersion, xrefs: 0068F5C5, 0068F5D8
LogonUser, xrefs: 0068F64F
Failed to get the formatted key path for update registration., xrefs: 0068F54D
PackageName, xrefs: 0068F5A5, 0068F5B8
Failed to create the key for update registration., xrefs: 0068F579
Date, xrefs: 0068F66F
InstalledBy, xrefs: 0068F64A, 0068F663
InstallerVersion, xrefs: 0068F6A7, 0068F6AC, 0068F6AD, 0068F6BD
InstalledDate, xrefs: 0068F66A, 0068F683
Failed to write %ls value., xrefs: 0068F6C2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 2305e5981b0ee2acfd6b35b04879f7574ea915d896c11134de2f985b60198ac6
Instruction ID: a58859fdb4c9671293a91c353bda8fd37b900dd88c664cf60182cf4a5938c4ec
Opcode Fuzzy Hash: 2305e5981b0ee2acfd6b35b04879f7574ea915d896c11134de2f985b60198ac6
Instruction Fuzzy Hash: A441A331E40625F7CB127754CC12FBE7A67EB11B50F12436AF801BA271E7A19E50A3D9

Function 0069E60C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0069E652
RegisterClassW.USER32(?), ref: 0069E67E
GetLastError.KERNEL32 ref: 0069E689
CreateWindowExW.USER32(00000080,006D91B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0069E6F0
GetLastError.KERNEL32 ref: 0069E6FA
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0069E798

Strings

WixBurnMessageWindow, xrefs: 0069E677, 0069E793
Failed to create window., xrefs: 0069E728
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 0069E6AD, 0069E71E
Unexpected return value from message pump., xrefs: 0069E783
Failed to register window., xrefs: 0069E6B7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 213125376-1202977178
Opcode ID: 8bb7d461a74c22afa6284d87e5e82276bb59f99279691c0deff7fdbe02b13e00
Instruction ID: a3e46f2c8cc4433f195096a9a31a6c19c11c3991cf0b7cf2a3accb66e006040e
Opcode Fuzzy Hash: 8bb7d461a74c22afa6284d87e5e82276bb59f99279691c0deff7fdbe02b13e00
Instruction Fuzzy Hash: 58418276900229ABDF10CFE49D48EDABFBAEF04754F11416AF905BA650D7319901CBA2

Function 006AC45E Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to copy key for passthrough pseudo bundle., xrefs: 006AC672
Failed to copy download source for passthrough pseudo bundle., xrefs: 006AC679
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 006AC6D1
Failed to copy filename for passthrough pseudo bundle., xrefs: 006AC6A8
Failed to copy install arguments for passthrough bundle package, xrefs: 006AC74C
Failed to copy related arguments for passthrough bundle package, xrefs: 006AC76C
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 006AC492, 006AC68B, 006AC6C5
Failed to copy key for passthrough pseudo bundle payload., xrefs: 006AC6AF
Failed to copy local source path for passthrough pseudo bundle., xrefs: 006AC6A1
Failed to copy cache id for passthrough pseudo bundle., xrefs: 006AC6EF
Failed to allocate memory for pseudo bundle payload hash., xrefs: 006AC697
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 006AC49E
Failed to recreate command-line arguments., xrefs: 006AC72D
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 006AC796

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1911474293
Opcode ID: fb8b82e7eba87d4081bb65a07b758d864c9055185e794b012234b33ef98d798c
Instruction ID: b781223d09791f86d757bd5e068a79da4b0f7971dc5afcce50f929a00e77d9b0
Opcode Fuzzy Hash: fb8b82e7eba87d4081bb65a07b758d864c9055185e794b012234b33ef98d798c
Instruction Fuzzy Hash: EAB16875A00616EFDB51EF68C881F55BBA2BB09710F11826AFD04AB362D731EC21DF80

Function 006ADAF8 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,00000000,00000000,?), ref: 006ADB13

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 006ADB29, 006ADC1C
Failed to copy download URL., xrefs: 006ADB5A
Failed to download BITS job., xrefs: 006ADCAA
Failed to set callback interface for BITS job., xrefs: 006ADC4B
Falied to start BITS job., xrefs: 006ADCCB
Invalid BITS engine URL: %ls, xrefs: 006ADB35
Failed to set credentials for BITS job., xrefs: 006ADBC1
Failed to create BITS job callback., xrefs: 006ADC26
Failed to add file to BITS job., xrefs: 006ADBE0
Failed to complete BITS job., xrefs: 006ADCBD
Failed to create BITS job., xrefs: 006ADBA2
Failed to initialize BITS job callback., xrefs: 006ADC34
Failed while waiting for BITS download., xrefs: 006ADCC4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 1659193697-397540975
Opcode ID: ee1935a918cfc8faa2798cead6d0e45460d726fad6767c487c7e33104ede98ea
Instruction ID: be54c759f0f98a60783d9d161fc3dd906d566f62068857eed924374211abd4e4
Opcode Fuzzy Hash: ee1935a918cfc8faa2798cead6d0e45460d726fad6767c487c7e33104ede98ea
Instruction Fuzzy Hash: F851E571A41225FBCB11BB94C885E9E7BABAF06B20B124159FC07AB751D7B0DD40DF90

Function 0068BC5E Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0068BCB0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 0068BDBD
GetLastError.KERNEL32(?,?,?,?), ref: 0068BDC7
WaitForInputIdle.USER32(?,?), ref: 0068BE1B
CloseHandle.KERNEL32(?), ref: 0068BE66
CloseHandle.KERNEL32(?), ref: 0068BE73

Strings

Failed to format obfuscated argument string., xrefs: 0068BD07
D, xrefs: 0068BD9C
Failed to CreateProcess on path: %ls, xrefs: 0068BDF8
"%ls", xrefs: 0068BD2D, 0068BD47
Failed to create executable command., xrefs: 0068BCEA
Failed to create obfuscated executable command., xrefs: 0068BD5B
"%ls" %s, xrefs: 0068BCD6, 0068BD17
Failed to format argument string., xrefs: 0068BCBB
c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp, xrefs: 0068BDEB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp
API String ID: 155678114-3058035682
Opcode ID: a19f90e09a363843abb85a1a8ea904691d4c6b851c7ef5e0c6b25ea4b757d056
Instruction ID: 964495e7aa7aa7f2a34471323c1604be6f5ccd3652b643e4ccca93e606a94763
Opcode Fuzzy Hash: a19f90e09a363843abb85a1a8ea904691d4c6b851c7ef5e0c6b25ea4b757d056
Instruction Fuzzy Hash: C0517F72D0061ABBCF12AFD0CC41DEEBB76FF04344B004669FA1076220E7729E509B95

Function 00694AB0 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 157sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00694B0A
GetLastError.KERNEL32 ref: 00694B18
Sleep.KERNEL32(00000064), ref: 00694B3C

Strings

Failed to allocate name of parent pipe., xrefs: 00694AD6
\\.\pipe\%ls, xrefs: 00694AC2
Failed to allocate name of parent cache pipe., xrefs: 00694BB1
\\.\pipe\%ls.Cache, xrefs: 00694B9D
Failed to open companion process with PID: %u, xrefs: 00694C64
Failed to verify parent pipe: %ls, xrefs: 00694B84
Failed to open parent pipe: %ls, xrefs: 00694B62
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00694B55, 00694C58

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 408151869-4133299158
Opcode ID: eb68fd6eab13372584ef48099d8ae354e78c27fc2edb76904e9a8b02bd0d402b
Instruction ID: ee74978d0c234fd4090574684894547daeb43ffd7f65fd049e1c389a03c363aa
Opcode Fuzzy Hash: eb68fd6eab13372584ef48099d8ae354e78c27fc2edb76904e9a8b02bd0d402b
Instruction Fuzzy Hash: C8410972D42632BFDF2156A09D06FAA765FAF00724F120225FE00BB790DB65DE0296D5

Function 006A673A Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,006A6C89,?), ref: 006A6773
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006A6C89,?,?,?), ref: 006A6780
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,006A6C89,?,?,?), ref: 006A67C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006A6C89,?,?,?), ref: 006A67D4
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,006A6C89,?,?,?), ref: 006A680E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006A6C89,?,?,?), ref: 006A6818
CloseServiceHandle.ADVAPI32(00000000), ref: 006A68CF
CloseServiceHandle.ADVAPI32(?), ref: 006A68D9

Strings

Failed to query status of WU service., xrefs: 006A6846
Failed to open WU service., xrefs: 006A6802
wuauserv, xrefs: 006A67C2
Failed to mark WU service to start on demand., xrefs: 006A68A0
Failed to open service control manager., xrefs: 006A67AE
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 006A67A4, 006A67F8, 006A683C
Failed to read configuration for WU service., xrefs: 006A687F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wuauserv
API String ID: 971853308-110228879
Opcode ID: 92cadf1ba294e463297525dff30e064d099ef79ef1fa4ce8d55f4ed9f3d3020a
Instruction ID: ea3581ebaef9293657f1866c948a92233b631060e6fb963a0c6703c28c447dbd
Opcode Fuzzy Hash: 92cadf1ba294e463297525dff30e064d099ef79ef1fa4ce8d55f4ed9f3d3020a
Instruction Fuzzy Hash: FC41A976E002295BD711FBA4CD45EAEB7ABAF05B54B0A4129FD01BB341D678DC008EA4

Function 006C6FC4 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 205COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 006C7024
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 006C7049
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 006C7069
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 006C709C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 006C70B8
SysFreeString.OLEAUT32(00000000), ref: 006C70E3
SysFreeString.OLEAUT32(00000000), ref: 006C715A
SysFreeString.OLEAUT32(00000000), ref: 006C71A6

Strings

rel, xrefs: 006C7017
length, xrefs: 006C705B
title, xrefs: 006C708E
type, xrefs: 006C70AA
href, xrefs: 006C703B
`)u, xrefs: 006C70E3, 006C715A, 006C71A6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$Compare$Free
String ID: `)u$href$length$rel$title$type
API String ID: 318886736-3452633465
Opcode ID: 89ad5aca08ac1ae33e1586e63fb1d5ad5a7b36c60a405af72513feb7ca91d29f
Instruction ID: e9a1bbd104aa79230ba699856e560d826f13b28a10a20d1da5cb052e2764878f
Opcode Fuzzy Hash: 89ad5aca08ac1ae33e1586e63fb1d5ad5a7b36c60a405af72513feb7ca91d29f
Instruction Fuzzy Hash: FA613E71A09219FBCB11DB94CC45FBEB7BAEF14320F2442A9F521A7690D731AA05DF90

Function 0068B1D7 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,0068BACA,00000008,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B1DF
GetLastError.KERNEL32(?,0068BACA,00000008,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 0068B1EB
_memcmp.LIBVCRUNTIME ref: 0068B293

Strings

c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 0068B20F, 0068B240, 0068B26B, 0068B2D4, 0068B2F5, 0068B31E, 0068B35E
burn, xrefs: 0068B2BA
.wixburn, xrefs: 0068B28D
Failed to read section info, unsupported version: %08x, xrefs: 0068B32D
Failed to read section info, data to short: %u, xrefs: 0068B2E3
Failed to find valid NT image header in buffer., xrefs: 0068B277
Failed to get module handle to process., xrefs: 0068B219
Failed to find Burn section., xrefs: 0068B301
.wix, xrefs: 0068B2B2
Failed to find valid DOS image header in buffer., xrefs: 0068B24C
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 0068B36A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3888311042-3868660166
Opcode ID: acfc5ca76d1e1ba91efa8f42bdd9d2b941636af2a8bf52a5772befe38bca01ef
Instruction ID: 1d326621ac9de345ac073b1911abbbfdc24e6bcec71e350c80f6d405ae672798
Opcode Fuzzy Hash: acfc5ca76d1e1ba91efa8f42bdd9d2b941636af2a8bf52a5772befe38bca01ef
Instruction Fuzzy Hash: E9413932280321A7D72076519C52FBE2663FF91B21B26527DF9126F381D7ADC902C3AD

Function 0068A249 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0068A271
RegCloseKey.ADVAPI32(00000000,000002C0,?,00000001,00000000,00000000,?,00000000,?,000002C0,000002C0,?,00000000,00000000,000000B8,00000100), ref: 0068A3C5

Strings

Failed to open registry key. Key = '%ls', xrefs: 0068A2C6
Registry key not found. Key = '%ls', xrefs: 0068A2B2
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0068A360
Failed to query registry key value., xrefs: 0068A353
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 0068A349
Failed to format key string., xrefs: 0068A27C
Failed to format value string., xrefs: 0068A2FD
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 0068A39D
Failed to set variable., xrefs: 0068A388

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseOpen@16
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1561904661-635686934
Opcode ID: 6ceccb6a49dce6696e974f98c44310a499a75565850b2a0f5c4e6a483e661bf0
Instruction ID: ffd8273740ef40344bcc5d9158e7e0501e0e87496069a4006da72bbe3222118c
Opcode Fuzzy Hash: 6ceccb6a49dce6696e974f98c44310a499a75565850b2a0f5c4e6a483e661bf0
Instruction Fuzzy Hash: AE41B072D40124BBEF127BE4CC02FFE7A6BEB04710F15426AFD04E6251D6719A109796

Function 0068695F Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 006869AF
GetLastError.KERNEL32 ref: 006869B9
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 006869FC
GetLastError.KERNEL32 ref: 00686A06
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00686B17

Strings

ntdll, xrefs: 006869A9
Failed to locate NTDLL., xrefs: 006869E7
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 006869DD, 00686A2A
RtlGetVersion, xrefs: 006869F1
Failed to get OS info., xrefs: 00686A57
Failed to locate RtlGetVersion., xrefs: 00686A34
Failed to set variant value., xrefs: 00686AFB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$c:\agent\_work\66\s\src\burn\engine\variable.cpp$ntdll
API String ID: 3057421322-3993976954
Opcode ID: 79706b18a663ac8b8c1e5897af68cd74b309b0a6897f0be3911ee2d4e1d06173
Instruction ID: 6084fdba796591c49021414536a996d17f1abdad61dc6ff4ede57b73e9f78e4e
Opcode Fuzzy Hash: 79706b18a663ac8b8c1e5897af68cd74b309b0a6897f0be3911ee2d4e1d06173
Instruction Fuzzy Hash: CF41E6729402399BDB25AB64CC05FEA7AB6EB08714F014299F909F6280D774DE80CB95

Function 00684936 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001), ref: 00684967
GetLastError.KERNEL32 ref: 00684978
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00684AB5
CloseHandle.KERNEL32(?), ref: 00684ABE

Strings

Failed to allocate thread local storage for logging., xrefs: 006849A6
Failed to set elevated pipe into thread local storage for logging., xrefs: 006849EF
Failed to create the message window., xrefs: 00684A13
Failed to pump messages from parent process., xrefs: 00684A89
Failed to connect to unelevated process., xrefs: 0068495D
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 0068499C, 006849E5

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 687263955-172022511
Opcode ID: ed98d3991d695d258dd4d1b801b82a1559b3980a7cc825cd2814bea0e2aed19c
Instruction ID: 65640725ef7f16a0cbe6b000b12e88aecdcceddcc948d97faf09c440cf9348bb
Opcode Fuzzy Hash: ed98d3991d695d258dd4d1b801b82a1559b3980a7cc825cd2814bea0e2aed19c
Instruction Fuzzy Hash: CA41D8B394062ABBCB15ABE08C45EEBB76EFF04754F01032AFA15E6140DF34A94087E5

Function 00693AD7 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 129COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,?), ref: 00693B2B
GetLastError.KERNEL32(?,00000000,?), ref: 00693B35
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,?), ref: 00693B9E
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,?), ref: 00693BA5
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,?), ref: 00693C2F

Strings

Failed to copy temp folder., xrefs: 00693C58
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 00693B59
Failed to get temp folder., xrefs: 00693B63
%u\, xrefs: 00693BBF
Failed to format session id as a string., xrefs: 00693BD3
Failed to get length of temp folder., xrefs: 00693B8F
Failed to get length of session id string., xrefs: 00693BFA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$c:\agent\_work\66\s\src\burn\engine\logging.cpp
API String ID: 2407829081-543404751
Opcode ID: f9c3d72bf6226a2385006c0f5fcc0921fc7bc0566d39d1ccc2f475b1e6044f76
Instruction ID: b05f648438a976a2bb1ef3bcb155651af611696d1fa26cb9eb952f69aaecc647
Opcode Fuzzy Hash: f9c3d72bf6226a2385006c0f5fcc0921fc7bc0566d39d1ccc2f475b1e6044f76
Instruction Fuzzy Hash: EA4193B2D8123DABCF219B608C4DFD9776EAF24710F110296F909B7340D6749F808B95

Function 00699692 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0069A724,?,00000000,00000000,00000000,00000000), ref: 006996AD
GetLastError.KERNEL32(?,0069A724,?,00000000,00000000,00000000,00000000,00000000), ref: 006996BD

Part of subcall function 006C3933: Sleep.KERNEL32(?,00000000,?,006984D1,?,?,00000001,00000003,000007D0,?,?,00000000,?,?,00000000,00000000), ref: 006C394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 006997C9

Strings

Failed to copy %ls to %ls, xrefs: 006997B7
%ls payload from working path '%ls' to path '%ls', xrefs: 00699774
Failed to open payload in working path: %ls, xrefs: 006996EC
Failed to move %ls to %ls, xrefs: 006997A1
Failed to verify payload hash: %ls, xrefs: 00699755
Moving, xrefs: 0069975F
Copying, xrefs: 00699768, 00699773
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 006996E1
Failed to verify payload signature: %ls, xrefs: 00699718

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-540362316
Opcode ID: bf36f2ca4b69c387f16611728525ee641dde12902714c8ea64bfc4e9df92169e
Instruction ID: f01e202222931192629f174ea16e8f123930b3dddb2b6b69e3f4dfa64cda62bc
Opcode Fuzzy Hash: bf36f2ca4b69c387f16611728525ee641dde12902714c8ea64bfc4e9df92169e
Instruction Fuzzy Hash: BC31F272D516707BDF212AA98C46FAB2A1EDF41F60F06011EFD006F791EA61CD0086F6

Function 006865DC Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 00686618

Part of subcall function 006C038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00685EE0,00000000), ref: 006C039E
Part of subcall function 006C038A: GetProcAddress.KERNEL32(00000000), ref: 006C03A5
Part of subcall function 006C038A: GetLastError.KERNEL32(?,?,?,00685EE0,00000000), ref: 006C03BC

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00686644
GetLastError.KERNEL32 ref: 00686652
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 0068668A
GetLastError.KERNEL32 ref: 00686694
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006866D7
GetLastError.KERNEL32 ref: 006866E1

Strings

Failed to backslash terminate system folder., xrefs: 00686724
Failed to get 64-bit system folder., xrefs: 00686680
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00686676, 006866B8
Failed to get 32-bit system folder., xrefs: 006866C2
Failed to set system folder variant value., xrefs: 00686740

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 325818893-3341528362
Opcode ID: e88932e7785a8f544a84b5eae2cf825e2cc4359205f02f74ea41c35019aa28dc
Instruction ID: a3c529d5ed4ac027233f56e14caa37e8a031f0707c71d5c3783394bfcc3d2f2d
Opcode Fuzzy Hash: e88932e7785a8f544a84b5eae2cf825e2cc4359205f02f74ea41c35019aa28dc
Instruction Fuzzy Hash: E231D672D41239A7D7217794CC4DFEA766AAF00758F014369FD05BB280E6749D808BE6

Function 00687FA2 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000001,00000000,?,00000000,00000000,00000001,00000000,00000002,00000000,00000000,00000001), ref: 00687FBF
LeaveCriticalSection.KERNEL32(?), ref: 006881E7

Strings

Failed to write variable count., xrefs: 00687FDA
Failed to write variable value type., xrefs: 006881C7
Failed to get string., xrefs: 006881B2
Unsupported variable type., xrefs: 006881A4
Failed to write variable name., xrefs: 006881CE
Failed to write variable value as number., xrefs: 00688191
Failed to get version., xrefs: 00688198
Failed to write literal flag., xrefs: 006881C0
Failed to write included flag., xrefs: 006881D5
Failed to get numeric., xrefs: 006881B9
Failed to write variable value as string., xrefs: 006881AB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.
API String ID: 3168844106-935306188
Opcode ID: b93f690ca2289e5a0aecbfdac7f750b30dc2b92df1764e17dee708416ab79119
Instruction ID: 8b60b763d13d5fb2b7e9ec130969f9debea10cb5b3f80bcd80c3bb1b856aeb5e
Opcode Fuzzy Hash: b93f690ca2289e5a0aecbfdac7f750b30dc2b92df1764e17dee708416ab79119
Instruction Fuzzy Hash: 5D71AE7290021AEFCB12EFA4CD48BEEBBA7FB04320F514225E941A7251DF30DD569B90

Function 00686DCB Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000100,00000000,00000000,00000000,?,006882B1,00000100,000002C0,0068A889,00000000,00000000), ref: 00686DDA

Part of subcall function 006856E2: CompareStringW.KERNELBASE(0000007F,00001000,00000100,000000FF,?,000000FF,00000000,00000000,00000000,?,?,?,00685DC2,00000000,00000100,00000000), ref: 0068571E
Part of subcall function 006856E2: GetLastError.KERNEL32(?,?,?,00685DC2,00000000,00000100,00000000,00000000,00000000,?,?,0068735E,00000000,00000100,00000000), ref: 0068574D

LeaveCriticalSection.KERNEL32(00000000,?,0068A889,00000000,00000000,00000000), ref: 00686F6A

Strings

Unsetting variable '%ls', xrefs: 00686EF3, 00686F26
Failed to find variable value '%ls'., xrefs: 00686DF5
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00686E5D
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00686F7C
Failed to set value of variable: %ls, xrefs: 00686F52
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00686EDF
Attempt to set built-in variable value: %ls, xrefs: 00686E68
Failed to insert variable '%ls'., xrefs: 00686E1F
Setting numeric variable '%ls' to value %lld, xrefs: 00686F0B
Setting string variable '%ls' to value '%ls', xrefs: 00686EFA, 00686F02
Setting hidden variable '%ls', xrefs: 00686E98

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2716280545-3393465121
Opcode ID: fe75bef8dbca480c3dc83e04b8c35c157a4ce2399cb0dd68a391dc0fe584041e
Instruction ID: d75c48a390dcca22fb4b5334748c1d6adfc664c2181b3715acdf9ef93f762957
Opcode Fuzzy Hash: fe75bef8dbca480c3dc83e04b8c35c157a4ce2399cb0dd68a391dc0fe584041e
Instruction Fuzzy Hash: 74510471A40215ABCB30BE18DC4AFBB3BABEB95714F24022DF9455A382C375D941CBE1

Function 006B8C92 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006B8CD6

Part of subcall function 006B880C: _free.LIBCMT ref: 006B8829
Part of subcall function 006B880C: _free.LIBCMT ref: 006B883B
Part of subcall function 006B880C: _free.LIBCMT ref: 006B884D
Part of subcall function 006B880C: _free.LIBCMT ref: 006B885F
Part of subcall function 006B880C: _free.LIBCMT ref: 006B8871
Part of subcall function 006B880C: _free.LIBCMT ref: 006B8883
Part of subcall function 006B880C: _free.LIBCMT ref: 006B8895
Part of subcall function 006B880C: _free.LIBCMT ref: 006B88A7
Part of subcall function 006B880C: _free.LIBCMT ref: 006B88B9
Part of subcall function 006B880C: _free.LIBCMT ref: 006B88CB
Part of subcall function 006B880C: _free.LIBCMT ref: 006B88DD
Part of subcall function 006B880C: _free.LIBCMT ref: 006B88EF
Part of subcall function 006B880C: _free.LIBCMT ref: 006B8901

_free.LIBCMT ref: 006B8CCB

Part of subcall function 006B5CE8: HeapFree.KERNEL32(00000000,00000000,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?), ref: 006B5CFE
Part of subcall function 006B5CE8: GetLastError.KERNEL32(?,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?,?), ref: 006B5D10

_free.LIBCMT ref: 006B8CED
_free.LIBCMT ref: 006B8D02
_free.LIBCMT ref: 006B8D0D
_free.LIBCMT ref: 006B8D2F
_free.LIBCMT ref: 006B8D42
_free.LIBCMT ref: 006B8D50
_free.LIBCMT ref: 006B8D5B
_free.LIBCMT ref: 006B8D93
_free.LIBCMT ref: 006B8D9A
_free.LIBCMT ref: 006B8DB7
_free.LIBCMT ref: 006B8DCF

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0c721e757b000f8ab7cee4a31864425b6dd3bc26d94151f46627f7a938a1f8d2
Instruction ID: 128b97b2ad861bb45fd5360109b42b2e82a1fd4430fcd4ea50d3c80d20754616
Opcode Fuzzy Hash: 0c721e757b000f8ab7cee4a31864425b6dd3bc26d94151f46627f7a938a1f8d2
Instruction Fuzzy Hash: A4311AB16007049FEBA1AA79D946BD67BEFBF10310F20441EE449D7291DF31A8C1CB28

Function 0069F748 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0069F784
UuidCreate.RPCRT4(?), ref: 0069F867
StringFromGUID2.OLE32(?,?,00000027), ref: 0069F888
LeaveCriticalSection.KERNEL32(?,?), ref: 0069F931

Strings

Failed to set update bundle., xrefs: 0069F90B
update\%ls, xrefs: 0069F7E0
Failed to convert bundle update guid into string., xrefs: 0069F8A7
Failed to default local update source, xrefs: 0069F7F4
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069F89D
Failed to recreate command-line for update bundle., xrefs: 0069F84F
Failed to create bundle update guid., xrefs: 0069F874

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp$update\%ls
API String ID: 171215650-494903540
Opcode ID: 2a7d1a845ccfab83bcef449e83def6a9fb978cac7cd87ba98a0e0135502bd9da
Instruction ID: be6ab17b60f9d17f0d20da676ddc30123ec3b350c9e138dd9aa5458649294634
Opcode Fuzzy Hash: 2a7d1a845ccfab83bcef449e83def6a9fb978cac7cd87ba98a0e0135502bd9da
Instruction Fuzzy Hash: DD519D31A00219ABCF619FA4DD45EEE7BBAEF08714F16417AF909EB651D7319C01CBA0

Function 00684B2A Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00684CA9
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00684CBA

Strings

Failed to set registration variables., xrefs: 00684C23
Failed to set action variables., xrefs: 00684C09
Failed while running , xrefs: 00684C6F
Failed to check global conditions, xrefs: 00684B8E
Failed to create the message window., xrefs: 00684BDD
Failed to query registration., xrefs: 00684BF3
WixBundleLayoutDirectory, xrefs: 00684C3A
Failed to open log., xrefs: 00684B5D
Failed to set layout directory variable to value provided from command-line., xrefs: 00684C4B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 149c5bba04e448e5d4d972539b15974eabb78e09874b70e650a852101a02041c
Instruction ID: 9ec74daeddb710d4e5f26235b013645efdedcdf57ecd7ef624260719c530c433
Opcode Fuzzy Hash: 149c5bba04e448e5d4d972539b15974eabb78e09874b70e650a852101a02041c
Instruction Fuzzy Hash: 4841F071A01A2BBBCB266AA4CC45FBAB66FFF04754F010329F801A2650EF60ED5097D5

Function 0069EE9A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 0069EEB7
LeaveCriticalSection.KERNEL32(?), ref: 0069EFE4

Strings

Engine is active, cannot change engine state., xrefs: 0069EED2
Failed to post launch approved exe message., xrefs: 0069EFCF
Failed to copy the id., xrefs: 0069EF49
UX requested unknown approved exe with id: %ls, xrefs: 0069EF17
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069EFC5
Failed to copy the arguments., xrefs: 0069EF76

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 1367039788-2920183924
Opcode ID: bcc4480da51e7ada3efc2a6deec48b7212420225d30c141b00820f8e06f18ce2
Instruction ID: 482647771958efa42456b46a62636dc34fd1986eced34b14228393a730bf73df
Opcode Fuzzy Hash: bcc4480da51e7ada3efc2a6deec48b7212420225d30c141b00820f8e06f18ce2
Instruction Fuzzy Hash: FE31C372A00625AFDB21EF64DC05EAA77AEEF00724B064527FC05EB750E672DD0087A4

Function 0069957D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0069A6B7,?,00000000,00000000,00000000,00000000), ref: 00699598
GetLastError.KERNEL32(?,0069A6B7,?,00000000,00000000,00000000,00000000,00000000), ref: 006995A6

Part of subcall function 006C3933: Sleep.KERNEL32(?,00000000,?,006984D1,?,?,00000001,00000003,000007D0,?,?,00000000,?,?,00000000,00000000), ref: 006C394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 00699684

Strings

Failed to copy %ls to %ls, xrefs: 00699672
%ls container from working path '%ls' to path '%ls', xrefs: 0069962F
Failed to move %ls to %ls, xrefs: 0069965C
Moving, xrefs: 0069961A
Copying, xrefs: 00699623, 0069962E
Failed to verify container hash: %ls, xrefs: 00699607
Failed to open container in working path: %ls, xrefs: 006995D5
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 006995CA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-3604842143
Opcode ID: eaa0b271a6829d9f71ffb21e161fbaac7983711d6721a2cc28590d6ca9df9b15
Instruction ID: 9fed80c6f8c4da3ea7780a1e4c46784f4a5f213f04ab49bbb526256ed87666a7
Opcode Fuzzy Hash: eaa0b271a6829d9f71ffb21e161fbaac7983711d6721a2cc28590d6ca9df9b15
Instruction Fuzzy Hash: 4E21F8B2E806347BEB221A289C46FBB261FDB41B65F12011DFD017A7C1D2A19D41C6F9

Function 00694177 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 006BFDEF: EnterCriticalSection.KERNEL32(006EB5D4,00000000,?,?,?,0069409F,00000001,?,00000000,?,00000000,00000000,?,00000001,?,?), ref: 006BFDFF
Part of subcall function 006BFDEF: LeaveCriticalSection.KERNEL32(006EB5D4,?,?,0069409F,00000001,?,00000000,?,00000000,00000000,?,00000001,?,?,00000000,?), ref: 006BFF46

OpenEventLogW.ADVAPI32(00000000,Application), ref: 0069419D
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 006941A9
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,H,m,00000000), ref: 006941F6
CloseEventLog.ADVAPI32(00000000), ref: 006941FD

Strings

H,m, xrefs: 006941E7
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 006941CD
txt, xrefs: 0069417D
Setup, xrefs: 00694187
Failed to open Application event log, xrefs: 006941D7
Application, xrefs: 00694197
_Failed, xrefs: 00694182

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$H,m$Setup$_Failed$c:\agent\_work\66\s\src\burn\engine\logging.cpp$txt
API String ID: 1844635321-461789307
Opcode ID: dc25787c9ce6bfcde19f6199056288f3e478983ae36134961869ed4c7706b68d
Instruction ID: a7bdd3b1cad028a947a40b4485a97253bb3a1ccdbfa871f5fa0da3bea50bac4e
Opcode Fuzzy Hash: dc25787c9ce6bfcde19f6199056288f3e478983ae36134961869ed4c7706b68d
Instruction Fuzzy Hash: F1F0A476E516323A57352762AD2DDBB1D7FDEE2F797020229FC00F5240EA444D4281F5

Function 00686F94 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?), ref: 00686FC1
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?), ref: 006871CD

Strings

Failed to read variable included flag., xrefs: 006871BD
Unsupported variable type., xrefs: 00687193
Failed to read variable count., xrefs: 00686FE1
Failed to read variable value as number., xrefs: 00687187
Failed to read variable literal flag., xrefs: 006871A8
Failed to read variable value as string., xrefs: 0068719A
Failed to read variable name., xrefs: 006871B6
Failed to read variable value type., xrefs: 006871AF
Failed to set variable value., xrefs: 00687180
Failed to set variable., xrefs: 006871A1

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: a94cecd72866933bd5167b3550076d5af42c1dc934af0983b03a64d2cc554471
Instruction ID: afb1c25dc4ceb2600eadafc52bf85e65cb0a71606a805f02a0f3faaec79e4ac1
Opcode Fuzzy Hash: a94cecd72866933bd5167b3550076d5af42c1dc934af0983b03a64d2cc554471
Instruction Fuzzy Hash: E071A171D0421ABBDF12EEA4CC49FEEBBBBEB45710F244225F940A6250D731DE419BA0

Function 006C3D01 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?), ref: 006C3D7E
GetLastError.KERNEL32 ref: 006C3D94
GetFileSizeEx.KERNEL32(00000000,?), ref: 006C3DE4
GetLastError.KERNEL32 ref: 006C3DEE
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 006C3E42
GetLastError.KERNEL32 ref: 006C3E4D
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 006C3F3C
CloseHandle.KERNEL32(?), ref: 006C3FAF

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C3D21, 006C3DCD, 006C3E0E, 006C3F92

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3286166115-1688708105
Opcode ID: a5dc5ca6ede5a019a3eb55b3a170dd7e5f62220ffdfd3c60a61e6d72e56b19b4
Instruction ID: efafa3714100697bc9d04ac00b67b6acad89d103ac1d759cbf2480cd58920db4
Opcode Fuzzy Hash: a5dc5ca6ede5a019a3eb55b3a170dd7e5f62220ffdfd3c60a61e6d72e56b19b4
Instruction Fuzzy Hash: 4C810372A00236ABDB219E598C04FBA76ABEF44760F11852EFD15EB380D674DF008795

Function 00683171 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040), ref: 006831BC
GetLastError.KERNEL32 ref: 006831C2
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 0068321C
GetLastError.KERNEL32 ref: 00683222
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 006832D6
GetLastError.KERNEL32 ref: 006832E0
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00683336
GetLastError.KERNEL32 ref: 00683340

Strings

@, xrefs: 00683196
c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 006831E6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: @$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-1835649624
Opcode ID: 36bc9cfe5d577681db3d5104ef8fa795f03c438fae662d152263a1e2f93b8ca9
Instruction ID: 41e893dda07337edbe5d88af3da7fc1aed907d4e45567104a72c57c8d0c79bd1
Opcode Fuzzy Hash: 36bc9cfe5d577681db3d5104ef8fa795f03c438fae662d152263a1e2f93b8ca9
Instruction Fuzzy Hash: B6619172D00679ABDB21BAD48845BDEBABAAF00F54F154365EE00BB350E7759F0087D4

Function 006C6527 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7591DFD0,?,006C6A99,?,?), ref: 006C657D
SysFreeString.OLEAUT32(00000000), ref: 006C65E8
SysFreeString.OLEAUT32(00000000), ref: 006C6660
SysFreeString.OLEAUT32(00000000), ref: 006C669F

Strings

label, xrefs: 006C656F
term, xrefs: 006C65B0
scheme, xrefs: 006C6590
`)u, xrefs: 006C65E8, 006C6660, 006C669F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$label$scheme$term
API String ID: 1324494773-995481605
Opcode ID: 7fa5d845afb568989a8b68bfe28026f3538b5a679240865690b90da42c465120
Instruction ID: ba3bddd81f2ced37b1f8e9544c893a192e5c497b79f823ece864dfe4caeb90af
Opcode Fuzzy Hash: 7fa5d845afb568989a8b68bfe28026f3538b5a679240865690b90da42c465120
Instruction Fuzzy Hash: 15514D31901219FBCB15DB95C854FFEBBBAEF04715F2442A8F911AB2A0D731AE00DB55

Function 00694D1A Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00694D4D
StringFromGUID2.OLE32(?,?,00000027), ref: 00694D7C
UuidCreate.RPCRT4(?), ref: 00694DC7
StringFromGUID2.OLE32(?,?,00000027), ref: 00694DF3

Strings

Failed to allocate pipe name., xrefs: 00694DBC
BurnPipe.%s, xrefs: 00694DA8
Failed to create pipe guid., xrefs: 00694D5A
Failed to allocate pipe secret., xrefs: 00694E1C
Failed to convert pipe guid into string., xrefs: 00694D99
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00694D8D, 00694DDA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 4041566446-1070039060
Opcode ID: 8f43076d58825fce9a801f06049b46bc6dd6755275e4db992d9f8aa09ab807ff
Instruction ID: bb91609697588cf0c48b1ddba238d1f259e38b2458f01736bc6540c0dd4ad092
Opcode Fuzzy Hash: 8f43076d58825fce9a801f06049b46bc6dd6755275e4db992d9f8aa09ab807ff
Instruction Fuzzy Hash: 98419F76D00318ABDF11EBE4C945EDEB7BEAF44710F21422AE905FB350DA749A0ACB51

Function 006C6402 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,7591DFD0), ref: 006C6461
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 006C647E
SysFreeString.OLEAUT32(00000000), ref: 006C64BC
SysFreeString.OLEAUT32(00000000), ref: 006C6500

Strings

email, xrefs: 006C6470
name, xrefs: 006C6453
`jl, xrefs: 006C640B, 006C641D
`)u, xrefs: 006C64BC, 006C6500
uri, xrefs: 006C648C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$CompareFree
String ID: `jl$`)u$email$name$uri
API String ID: 3589242889-128293360
Opcode ID: 70548475615b7e58a7835b095024d1de9a500cbeef131ed433bf0b9bdfc6c539
Instruction ID: ca307508e66e1217909ddcfb129aa713be2630e129beb91e4d4df283d733fdcc
Opcode Fuzzy Hash: 70548475615b7e58a7835b095024d1de9a500cbeef131ed433bf0b9bdfc6c539
Instruction Fuzzy Hash: 6B416D32905219FBCF159B94CC44FADB7B6EF00725F20C2A8F911AB2D0C7319A04DB54

Function 0069E8CE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000), ref: 0069E8EE
GetLastError.KERNEL32 ref: 0069E8FB
CreateThread.KERNEL32(00000000,00000000,0069E60C,?,00000000,00000000), ref: 0069E954
GetLastError.KERNEL32 ref: 0069E961
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0069E99C
CloseHandle.KERNEL32(00000000), ref: 0069E9BB
CloseHandle.KERNEL32(?), ref: 0069E9C8

Strings

Failed to create the UI thread., xrefs: 0069E98C
Failed to create initialization event., xrefs: 0069E926
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 0069E91C, 0069E982

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 2351989216-1290259148
Opcode ID: 59c3719a3f50e77b705e0148e84d19b2adefe70939c6856c536e2859aea91a11
Instruction ID: 127ec215da288389a347fbf54f2a3704fe47572f5af2371fa09ebb7e4d89a118
Opcode Fuzzy Hash: 59c3719a3f50e77b705e0148e84d19b2adefe70939c6856c536e2859aea91a11
Instruction Fuzzy Hash: 94319776D0122ABBDB10DFD98D44AEFBABDBF04754F110166F905F7340D6359E0086A1

Function 0069E4A1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 0069E4C2
GetLastError.KERNEL32 ref: 0069E4CF
CreateThread.KERNEL32(00000000,00000000,0069E226,?,00000000,00000000), ref: 0069E52E
GetLastError.KERNEL32 ref: 0069E53B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0069E576
CloseHandle.KERNEL32(?), ref: 0069E58A
CloseHandle.KERNEL32(?), ref: 0069E597

Strings

Failed to create UI thread., xrefs: 0069E566
c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 0069E4F0, 0069E55C
Failed to create modal event., xrefs: 0069E4FA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2351989216-1795443032
Opcode ID: 2561a0472048c44b1a0b0e9df6e11cae568b9625c4e3a4bc5bf2ae82686f9a9f
Instruction ID: 877a883ee4ca08b774e4eef307ce4e18f4a1da3c189602a2aaf7b26c9e121f65
Opcode Fuzzy Hash: 2561a0472048c44b1a0b0e9df6e11cae568b9625c4e3a4bc5bf2ae82686f9a9f
Instruction Fuzzy Hash: 3E31B976D00229BBDB21DB99CC05EAFBBBAAB44754F01412AFD10F7340E6358A00CBA1

Function 006A1286 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,75922F60,?,?), ref: 006A12AA
GetLastError.KERNEL32 ref: 006A12BD
GetExitCodeThread.KERNEL32(?,00000000), ref: 006A12FF
GetLastError.KERNEL32 ref: 006A130D
ResetEvent.KERNEL32(?), ref: 006A1348
GetLastError.KERNEL32 ref: 006A1352

Strings

Failed to get extraction thread exit code., xrefs: 006A133E
Failed to wait for operation complete event., xrefs: 006A12EE
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A12E4, 006A1334, 006A1379
Failed to reset operation complete event., xrefs: 006A1383

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-3513947302
Opcode ID: 05178271f3b05342ca1396218cb0243c458c88e3213e68b8a21c5431198daf65
Instruction ID: 86d8d72528f0975200ba526674070ecaf8c2d3250ff5579cef40c21cc179128e
Opcode Fuzzy Hash: 05178271f3b05342ca1396218cb0243c458c88e3213e68b8a21c5431198daf65
Instruction Fuzzy Hash: EA318670A40319EBEB10EFA58D05BBE77EBAF02705F104159F905EE2A0E679DE009F65

Function 006A13A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,00000000,?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000,?), ref: 006A13BD
GetLastError.KERNEL32(?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000,?,006854C6,FFF9E89D,006854C6), ref: 006A13C7
WaitForSingleObject.KERNEL32(?,000000FF,?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000,?,006854C6), ref: 006A1401
GetLastError.KERNEL32(?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000,?,006854C6,FFF9E89D,006854C6), ref: 006A140B
CloseHandle.KERNEL32(00000000,006854C6,?,00000000,?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000), ref: 006A1456
CloseHandle.KERNEL32(00000000,006854C6,?,00000000,?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000), ref: 006A1465
CloseHandle.KERNEL32(00000000,006854C6,?,00000000,?,0068C198,?,006853FA,00000000,?,00697740,?,006856AA,006854B6,006854B6,00000000), ref: 006A1474

Strings

Failed to set begin operation event., xrefs: 006A13F5
Failed to wait for thread to terminate., xrefs: 006A1439
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A13EB, 006A142F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1206859064-3195532870
Opcode ID: db434816e98b8162d9d49ef2b53c50b5eb09f1e62bac0dacf50fa3fb25cb0f19
Instruction ID: 4813e79644447ab8f127e276a944619a298e6b65a28091596dc3bd0082330def
Opcode Fuzzy Hash: db434816e98b8162d9d49ef2b53c50b5eb09f1e62bac0dacf50fa3fb25cb0f19
Instruction Fuzzy Hash: 1E213732500A36B7D7317B69CC09B95B6E7FF0A725F010225E9046AB90D378EC50CED8

Function 006992CD Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,00000003,00000000,00000000,00000003,00000000,00000000), ref: 00699380
GetLastError.KERNEL32(?,000007D0,00000000,00000000,000007D0,00000001), ref: 006993A8

Strings

$, xrefs: 0069947F
Failed to get file hash., xrefs: 006993D2
Could not close verify handle., xrefs: 00699537
Could not verify file %ls., xrefs: 006994E9
Failed to encode file hash., xrefs: 00699433
0, xrefs: 00699440
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 006993C8, 006994DC, 0069952D
Failed to allocate memory, xrefs: 0069933E
Failed to allocate string., xrefs: 00699416

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1452528299-3123085469
Opcode ID: 16705c2b6f508d2bd4c8b3755ba4dce84477cc67ecf188da2e3b38ab7d80464a
Instruction ID: b9805e469eb07ec5ec66ec84e083b6c4ef044d76e8b85a2cca31b7e4ef01f64c
Opcode Fuzzy Hash: 16705c2b6f508d2bd4c8b3755ba4dce84477cc67ecf188da2e3b38ab7d80464a
Instruction Fuzzy Hash: 54818272D002299BDF51DFA8C841BEEB7BAAF08710F11012AF915BB381E7759D45CBA4

Function 0069E3C8 Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0069E3D3
DefWindowProcW.USER32(?,00000082,?,?), ref: 0069E411
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0069E41E
SetWindowLongW.USER32(?,000000EB,?), ref: 0069E42D
DefWindowProcW.USER32(?,?,?,?), ref: 0069E43B
CreateCompatibleDC.GDI32(?), ref: 0069E447
SelectObject.GDI32(00000000,00000000), ref: 0069E458
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0069E47A
SelectObject.GDI32(00000000,00000000), ref: 0069E482
DeleteDC.GDI32(00000000), ref: 0069E485
PostQuitMessage.USER32(00000000), ref: 0069E493

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 44cea54719258f9cbe87aea8baf62d129f0cc16898c7b6400a17c1230246a5e6
Instruction ID: 637c704b10d0923d232a07a994b9804c860753e639b10e301422b2f1e0d3c7b9
Opcode Fuzzy Hash: 44cea54719258f9cbe87aea8baf62d129f0cc16898c7b6400a17c1230246a5e6
Instruction Fuzzy Hash: C3218E32100208BFDF159FB8DD1CD7B3FAAFB49B64B054618F61A962A0C6728810DB62

Function 00692C15 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,00000000,?,?,?,?,?,00000001,00000000), ref: 00692C83

Strings

Failed to check for remaining dependents during planning., xrefs: 00692E29
Failed to add registration action for self dependent., xrefs: 00692F50
Failed to add self-dependent to ignore dependents., xrefs: 00692D07
Failed to allocate registration action., xrefs: 00692CEC
Failed to add dependents ignored from command-line., xrefs: 00692D38
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00692DED
Failed to add registration action for dependent related bundle., xrefs: 00692F85
Failed to create the string dictionary., xrefs: 00692CBC

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.
API String ID: 1825529933-2086987450
Opcode ID: d41cc2427bd82670cf34df5dcf4d6d7fe65e95a833d1267c9a99811ae491e6bf
Instruction ID: 6b41a842212555cb64c7849e92e4a3be1e6e570f7ee302849b139169b8331d35
Opcode Fuzzy Hash: d41cc2427bd82670cf34df5dcf4d6d7fe65e95a833d1267c9a99811ae491e6bf
Instruction Fuzzy Hash: 51B18B70A00216FFCF299F54C8A1AAE7BBABF04310F10816AF819ABB51D770D951CBD1

Function 0069A00C Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

Failed to combine last source with source., xrefs: 0069A0EE
WixBundleLastUsedSource, xrefs: 0069A075
Failed to combine layout source with source., xrefs: 0069A183
WixBundleLayoutDirectory, xrefs: 0069A149
Failed to copy source path., xrefs: 0069A1FD
Failed to get current process directory., xrefs: 0069A0CF
WixBundleOriginalSource, xrefs: 0069A090
Failed to get bundle layout directory property., xrefs: 0069A164

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: 634543a62fd1888411c12b9138a2afc8fba4703aa6359603e1a1d5c5f2ddd6f2
Instruction ID: b9f245bdb5a94281a7e73e907619458c9616454af7abe83ff38956c1adb1defe
Opcode Fuzzy Hash: 634543a62fd1888411c12b9138a2afc8fba4703aa6359603e1a1d5c5f2ddd6f2
Instruction Fuzzy Hash: 81816C71D00229ABCF51EFE8D9819EEBBFAAF08710F14012AE911B7750D7319D01CBA6

Function 00682EBC Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00682F5C
GetLastError.KERNEL32 ref: 00682F66
GetLocalTime.KERNEL32(?,?,?), ref: 00683006
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00683093
GetLastError.KERNEL32 ref: 006830A0
Sleep.KERNEL32(00000064), ref: 006830B4
CloseHandle.KERNEL32(?), ref: 0068311C

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00682F8A
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00683063

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-3233915199
Opcode ID: 478a48d8ee4f3594ec4bf7940125b3c2b1b771b6b73e20d7783c7bb942ada573
Instruction ID: 671fe60869370e561a0e0637e65aef54c752b188227c95a4078e541a9123222a
Opcode Fuzzy Hash: 478a48d8ee4f3594ec4bf7940125b3c2b1b771b6b73e20d7783c7bb942ada573
Instruction Fuzzy Hash: E0718572D41239ABDB70AF94DD49BE9B3BAAB08B10F000295FA45A7390D7749E81CF54

Function 0068CB82 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,006853FA,00000000,006854C6,00685482,WixBundleUILevel,840F01E8,?,00000001), ref: 0068CBD9

Strings

Failed to ensure directory exists, xrefs: 0068CCAB
Failed to get directory portion of local file path, xrefs: 0068CCB2
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 0068CCDA
Failed to concat file paths., xrefs: 0068CCB9
Failed to find embedded payload: %ls, xrefs: 0068CC05
Payload was not found in container: %ls, xrefs: 0068CCE6
Failed to extract file., xrefs: 0068CCA4
Failed to get next stream., xrefs: 0068CCC0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\66\s\src\burn\engine\payload.cpp
API String ID: 1825529933-3317369491
Opcode ID: 497b3f4e3998302e81ad8e8cec8f5ea5e642fe387b63dc407d2537b1eeae6fb6
Instruction ID: cd7e8640df50703fa58f6dfd3e07a3cb7ed3474d2d8eac5389226485838f5c3c
Opcode Fuzzy Hash: 497b3f4e3998302e81ad8e8cec8f5ea5e642fe387b63dc407d2537b1eeae6fb6
Instruction Fuzzy Hash: 3F419F31900215EFCF25BF94CD91EAEBBB7EF40720B11826AE815BB351D6719D40DBA0

Function 006A99B4 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,006AAD39,?,00000001,00000000), ref: 006A9A3F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,006AAD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 006A9A49
CopyFileExW.KERNEL32(00000000,00000000,006A988D,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 006A9A97
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,006AAD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 006A9AC6

Strings

Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 006A9AF8
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 006A9ABF
copy, xrefs: 006A9A0D
Failed to clear readonly bit on payload destination path: %ls, xrefs: 006A9A78
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 006A9A6D, 006A9AB1, 006A9AEA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$copy
API String ID: 1969131206-3140072123
Opcode ID: 04d9b2551e76ccb7ca4e7f8d13d3b9d5d4ad4dcedda462dbf0a0695c6695be7b
Instruction ID: 3ed9d10a9b5888d55b7edeed1d42170d91e2a71877ecf92466af096c3c683b2d
Opcode Fuzzy Hash: 04d9b2551e76ccb7ca4e7f8d13d3b9d5d4ad4dcedda462dbf0a0695c6695be7b
Instruction Fuzzy Hash: 55311972B01125B7DB107E968C46EAB776BAF83B50B29811EBD05EF341D664CD01CBB0

Function 00698D91 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00698EDC

Strings

Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00698E05
Failed to create ACL to secure cache path: %ls, xrefs: 00698E90
Failed to allocate access for Everyone group to path: %ls, xrefs: 00698E26
Failed to allocate access for Administrators group to path: %ls, xrefs: 00698DE4
Failed to allocate access for Users group to path: %ls, xrefs: 00698E47
Failed to secure cache path: %ls, xrefs: 00698EBF
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00698E85

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2826327444-3220527011
Opcode ID: 9dcf6bd38f6ecac3fc93065c698d5dae89540bb7c11b02f1a42659db5922ef55
Instruction ID: 8a30dd13832b92f03e01aa8ba4529ab96b542e1b8685b92a445caf5850b1c6d2
Opcode Fuzzy Hash: 9dcf6bd38f6ecac3fc93065c698d5dae89540bb7c11b02f1a42659db5922ef55
Instruction Fuzzy Hash: 3F311572E40229BBDF319650CC12FFE7A6EAB42B10F110166FA04BB6C1DEB09D4497A4

Function 0069E10F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 0069E145
GetLastError.KERNEL32 ref: 0069E151
GetObjectW.GDI32(00000000,00000018,?), ref: 0069E198
GetCursorPos.USER32(?), ref: 0069E1B9
MonitorFromPoint.USER32(?,?,00000002), ref: 0069E1CB
GetMonitorInfoW.USER32(00000000,?), ref: 0069E1E1

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 0069E175
Failed to load splash screen bitmap., xrefs: 0069E17F
(, xrefs: 0069E1D8

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2342928100-3540601290
Opcode ID: 8a8eb40166116bd0dd3ff7bdcb4bb15e76a157714ec9b7915f9797316ab4d8e2
Instruction ID: 01786c8dbaef4af05acb2b485447cdd21e2e5092753574aae45af9a15585e3e5
Opcode Fuzzy Hash: 8a8eb40166116bd0dd3ff7bdcb4bb15e76a157714ec9b7915f9797316ab4d8e2
Instruction Fuzzy Hash: 18313275E00219AFDB10DFB8DD45A9EBBFAFF08710F158119E904EB281DB75E9048B61

Function 00695053 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?), ref: 0069505C
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 006950FA
CloseHandle.KERNEL32(00000000), ref: 00695113

Strings

open, xrefs: 006950C4, 006950D2
Failed to allocate parameters for elevated process., xrefs: 00695095
burn.elevated, xrefs: 0069507C
runas, xrefs: 006950BA
-q -%ls %ls %ls %u, xrefs: 00695081
Failed to launch elevated child process: %ls, xrefs: 006950E7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: ac03b3f4a2a9a1d8bf1c71aa8b07db50447ae2ae64c48ed132077b9540d8d055
Instruction ID: d0aafec60c338f5fce4c70a05e17b9eb7437f6bf1174bcc0a7ea4f59d9d026d8
Opcode Fuzzy Hash: ac03b3f4a2a9a1d8bf1c71aa8b07db50447ae2ae64c48ed132077b9540d8d055
Instruction Fuzzy Hash: EA2148B1D00629FF8F02AF94DC858AEBBBAEF04354B10816AF806A2310D7719F50DB95

Function 00686898 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 006868C2
GetProcAddress.KERNEL32(00000000), ref: 006868C9
GetLastError.KERNEL32 ref: 006868D3

Strings

Failed to find DllGetVersion entry point in msi.dll., xrefs: 00686901
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 006868F7
Failed to get msi.dll version info., xrefs: 0068691B
DllGetVersion, xrefs: 006868B4
msi, xrefs: 006868B9
Failed to set variant value., xrefs: 0068693F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$msi
API String ID: 4275029093-3573271201
Opcode ID: 1222cf2624d7a69c688036a988f93749883265b931de2a193b134602de867d67
Instruction ID: c70fd0c9509979938fe532895ee32179e1b468875c9fcc0f7805e568ba8aa294
Opcode Fuzzy Hash: 1222cf2624d7a69c688036a988f93749883265b931de2a193b134602de867d67
Instruction Fuzzy Hash: DE11D672A0163666D710B7A8CC46EBF7BA6EB04B60F11052DFE05F6281DA74DC0483E5

Function 0068D679 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000008,00000000,?,00684847,?,?,?,?,00000000,?), ref: 0068D68A
GetLastError.KERNEL32(?,00684847,?,?,?,?,00000000,?), ref: 0068D697
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0068D6CF
GetLastError.KERNEL32(?,00684847,?,?,?,?,00000000,?), ref: 0068D6DB

Strings

BootstrapperApplicationCreate, xrefs: 0068D6C9
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 0068D706
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 0068D6B8, 0068D6FC
Failed to load UX DLL., xrefs: 0068D6C2
Failed to create UX., xrefs: 0068D71F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-3967977479
Opcode ID: 30bd1e2dd37bac79aa1aa1a57ad94255034d7fc1d9bc5b1b556488c1c3031171
Instruction ID: c7a5983c2b363fe034b58f52d63959e56ad77b93b6487439c4501443a6338a8d
Opcode Fuzzy Hash: 30bd1e2dd37bac79aa1aa1a57ad94255034d7fc1d9bc5b1b556488c1c3031171
Instruction Fuzzy Hash: 3611C837A80736A7D72177949C05F6B6797AB04B65F064229FE05FB3C0EA55DC0047E4

Function 00681173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00681184
GetModuleHandleW.KERNEL32(kernel32), ref: 0068118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0068119D
GetLastError.KERNEL32 ref: 006811B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 006811C0
GetLastError.KERNEL32 ref: 006811D5

Strings

kernel32, xrefs: 0068118A
SetDefaultDllDirectories, xrefs: 00681197
SetDllDirectoryW, xrefs: 006811BA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: e8ffdf1c5db373b6d7a88e7581f65c39029e896d809aa2f5650be5945379899b
Instruction ID: e89eb924a8dbcc89fc43be1e649c4b17935aa9d3ac8019c3958e7378c1314f03
Opcode Fuzzy Hash: e8ffdf1c5db373b6d7a88e7581f65c39029e896d809aa2f5650be5945379899b
Instruction Fuzzy Hash: B201B53130021A7AD7107BE69C0DEBB7B2EFB417A97014115F985E6240D670D9458BA2

Function 0069F47A Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0069F48F
LeaveCriticalSection.KERNEL32(?), ref: 0069F60A

Strings

UX requested unknown container with id: %ls, xrefs: 0069F534
Failed to set download user., xrefs: 0069F592
Engine is active, cannot change engine state., xrefs: 0069F4A9
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 0069F4FA
UX requested unknown payload with id: %ls, xrefs: 0069F4E4
Failed to set download password., xrefs: 0069F5B8
Failed to set download URL., xrefs: 0069F569
UX did not provide container or payload id., xrefs: 0069F5F9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 16a1dc937459952cdbb674806e03862410c722d770fb8d5eca1e70955dbfcad1
Instruction ID: 71273a0bebfd35cdeac56911a8613e1150a27f9e2747cf3d3c0735bd0cf82226
Opcode Fuzzy Hash: 16a1dc937459952cdbb674806e03862410c722d770fb8d5eca1e70955dbfcad1
Instruction Fuzzy Hash: B241E472900212ABCF61AF64C845EAA77AFAF20714B2B817AF805E7750E770DD50C7A4

Function 006B5835 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006B5849

Part of subcall function 006B5CE8: HeapFree.KERNEL32(00000000,00000000,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?), ref: 006B5CFE
Part of subcall function 006B5CE8: GetLastError.KERNEL32(?,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?,?), ref: 006B5D10

_free.LIBCMT ref: 006B5855
_free.LIBCMT ref: 006B5860
_free.LIBCMT ref: 006B586B
_free.LIBCMT ref: 006B5876
_free.LIBCMT ref: 006B5881
_free.LIBCMT ref: 006B588C
_free.LIBCMT ref: 006B5897
_free.LIBCMT ref: 006B58A2
_free.LIBCMT ref: 006B58B0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a6ae7543896b4b913becdf9d8673fe44ccc7d0f41158609748e073c2de717e2a
Instruction ID: a0832c3ff3e6044a19ca4b7e36364a790cfa5c52664a3346d8c2b5df80f83224
Opcode Fuzzy Hash: a6ae7543896b4b913becdf9d8673fe44ccc7d0f41158609748e073c2de717e2a
Instruction Fuzzy Hash: 40117AB5510608AFCB81EF54C942DDD3F67FF05350B9140A9BA0A5F122DB31EE91DB88

Function 006C5253 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,000002C0,000000FF,?,00000000,00000000), ref: 006C5290
GetLastError.KERNEL32 ref: 006C529E
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 006C52DF
GetLastError.KERNEL32 ref: 006C52EC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 006C545F
CloseHandle.KERNEL32(?), ref: 006C546E

Strings

GET, xrefs: 006C5393
c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 006C52C2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-547604341
Opcode ID: cdcc510637f067069fe0f0afe0f741780b58f3361360f8b24d01fa76cd38d22a
Instruction ID: 6b38465839f066995dd4100734c8aacc394a1e4e5851853224bb01993c9c117a
Opcode Fuzzy Hash: cdcc510637f067069fe0f0afe0f741780b58f3361360f8b24d01fa76cd38d22a
Instruction Fuzzy Hash: FE615A72A0061AABDB118FA4CC44FFE7BBAEB48355F15411DFD06E6240E774E9808B94

Function 00690BE7 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00690FB3: CompareStringW.KERNEL32(00000000,00000000,?,000000FF,00000000,000000FF,00000000,00000000,?,?,00690C06,?,00000000,?,00000000,00000000), ref: 00690FE2

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00690D8A
GetLastError.KERNEL32 ref: 00690D97

Strings

Failed to append payload cache action., xrefs: 00690D41
Failed to append rollback cache action., xrefs: 00690C66
Failed to append package start action., xrefs: 00690C2C
Failed to create syncpoint event., xrefs: 00690DC5
Failed to append cache action., xrefs: 00690CE1
c:\agent\_work\66\s\src\burn\engine\plan.cpp, xrefs: 00690DBB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$c:\agent\_work\66\s\src\burn\engine\plan.cpp
API String ID: 801187047-574661624
Opcode ID: 3139306a2a3e961d0648a25fcc10088bfd9acfecb1b34468b502b6a66bbf4e32
Instruction ID: 34276412dfa471275bee08b099db07060288113c7b830a36fc264d5d263147e0
Opcode Fuzzy Hash: 3139306a2a3e961d0648a25fcc10088bfd9acfecb1b34468b502b6a66bbf4e32
Instruction Fuzzy Hash: C5616C75900605EFDB05DF58C980AAEBBFFEF88310B21845AE8059B711EB71EE41DB50

Function 006C66D4 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7591DFD0,000000FF,type,000000FF,?,7591DFD0,7591DFD0,7591DFD0), ref: 006C672A
SysFreeString.OLEAUT32(00000000), ref: 006C6775
SysFreeString.OLEAUT32(00000000), ref: 006C67F1
SysFreeString.OLEAUT32(00000000), ref: 006C683D

Strings

type, xrefs: 006C671C
`)u, xrefs: 006C6775, 006C67F1, 006C683D
url, xrefs: 006C673D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$type$url
API String ID: 1324494773-3139739812
Opcode ID: 25d82183d8f187ccd553d0882cd45d87f7c5344d11c02d47e381359381e471bc
Instruction ID: d9fee1080df8617fe010e71ec2612a4e56d5015ea8855487cf53fb906aeaa978
Opcode Fuzzy Hash: 25d82183d8f187ccd553d0882cd45d87f7c5344d11c02d47e381359381e471bc
Instruction Fuzzy Hash: 1E511931902219EBCB15DBA4C894FEEBBBAEF04715F1445A9F911AB2A0D7319E00DB64

Function 00689E89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00689EAF
_MREFOpen@16.MSPDB140-MSVCRT ref: 00689ED4

Strings

Failed to format product code string., xrefs: 00689EDF
Failed to get component path: %d, xrefs: 00689F38
Failed to format component id string., xrefs: 00689EBA
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00689FC8
Failed to set variable., xrefs: 00689FB8

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: 19a3077f6253553a1ca293840080b289695bddae7fe6176cbe0005a0d901442d
Instruction ID: 4f71359624867f229ec1dc3739d6b5b0c9c056f6b0141a1512f056c0ef992cf3
Opcode Fuzzy Hash: 19a3077f6253553a1ca293840080b289695bddae7fe6176cbe0005a0d901442d
Instruction Fuzzy Hash: 3641D672904115BACB29BA688D46FFEB67BEF00310F2C476AF600E2291D771D950DBA5

Function 006847DF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000400,00000400,00000000), ref: 00684804
GetCurrentThreadId.KERNEL32 ref: 0068480A
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00684898

Strings

Failed to start bootstrapper application., xrefs: 00684866
Failed to create engine for UX., xrefs: 00684824
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 006848E4
Unexpected return value from message pump., xrefs: 006848EE
Failed to load UX., xrefs: 0068484D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 673430819-3688956121
Opcode ID: 2c8cd7d5f26504a36dff252e45b720729e66c6481dbdbbd944588550f4fb12b7
Instruction ID: e7088b70ab2de53f35316e3853321d54755f3222c4030f9ae8bac468798f438a
Opcode Fuzzy Hash: 2c8cd7d5f26504a36dff252e45b720729e66c6481dbdbbd944588550f4fb12b7
Instruction Fuzzy Hash: AE41A0B1600616BFEB54ABA4CC85EFB77AEEF04318F100229F515E7290EF24ED4587A5

Function 006BFBC6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 006BFC0A
GetComputerNameW.KERNEL32(?,?), ref: 006BFC62

Strings

Computer : %ls, xrefs: 006BFCD0
Zn, xrefs: 006BFD03
Executable: %ls v%d.%d.%d.%d, xrefs: 006BFCBE
Zn, xrefs: 006BFCFB
--- logging level: %hs ---, xrefs: 006BFD22
=== Logging started: %ls ===, xrefs: 006BFC8D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d$Zn$Zn
API String ID: 2577110986-1647532749
Opcode ID: bf165a6c5f7d1d1f74954796e9b6c77263fca839098db10cdfb9c3187720f73b
Instruction ID: 994b19efad367e9147ed8a02f09de23eef8f05a6a391f301983b28a19aa4cd21
Opcode Fuzzy Hash: bf165a6c5f7d1d1f74954796e9b6c77263fca839098db10cdfb9c3187720f73b
Instruction Fuzzy Hash: 6D4142F290022C9BCB60DFA4DD85EEA77BEEB54304F1041B9FA05A7151D630AEC58F65

Function 006948B9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000001,00000008,?,00000000,?,00000000,00000000,00000001,00000000,?,?,?,?,?), ref: 006948E4
GetLastError.KERNEL32 ref: 006948F1
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,00000000), ref: 0069499C
GetLastError.KERNEL32 ref: 006949A6

Strings

Failed to read message from pipe., xrefs: 00694971
Failed to read data for message., xrefs: 006949D4
Failed to allocate data for message., xrefs: 0069495A
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00694950, 00694967, 006949CA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1948546556-3469126999
Opcode ID: 6b564d987e868016272ba3bb12ff2df4ed30d6877dba6b19a92f078c5aa0b93f
Instruction ID: c9278bae92d480bc781b331d3c4686bcb6646a928fd8f9ad4ff88bb3efa5f9db
Opcode Fuzzy Hash: 6b564d987e868016272ba3bb12ff2df4ed30d6877dba6b19a92f078c5aa0b93f
Instruction Fuzzy Hash: 6031E432E0023AABDF109AA48D05FABB76EAB00755F11812AF941A6780EB749E0187D5

Function 006C0E2F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000,BundleUpgradeCode), ref: 006C0E6B
lstrlenW.KERNEL32(?,00000002,00000001,?,00000000,BundleUpgradeCode), ref: 006C0ECD
lstrlenW.KERNEL32(?), ref: 006C0ED9
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,?,00000000,BundleUpgradeCode), ref: 006C0F1C

Strings

<]n, xrefs: 006C0E49
<]n, xrefs: 006C0EAD, 006C0EC4
BundleUpgradeCode, xrefs: 006C0E38
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C0F44

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: lstrlen$Value
String ID: <]n$<]n$BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 198323757-1450237319
Opcode ID: 1e3827b62d23f49951eb02804a39c274f3b3cdb39a0ec71c0b0340e895dfce42
Instruction ID: 61c53cdbb37041e82cfe9aeed2755086813a730c554715cea56d1890feb28a2a
Opcode Fuzzy Hash: 1e3827b62d23f49951eb02804a39c274f3b3cdb39a0ec71c0b0340e895dfce42
Instruction Fuzzy Hash: 0D319372900229EFDB219F988C85EAEBB7AFF44750F05455DFD10AB210C770DD518BA0

Function 0068F3F9 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0068F432

Part of subcall function 0068415F: CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,?,00682FD9,?,00000000,?,?), ref: 0068416D
Part of subcall function 0068415F: GetLastError.KERNEL32(?,00682FD9,?,00000000,?,?), ref: 0068417B

lstrlenA.KERNEL32(?,00000000,?,00000000,?,?,00690458,00000000,?,?,00000000,?,00690458,?,?), ref: 0068F485

Part of subcall function 006C45C9: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,00690458,00000000,?,0068F49C,?,00000080,?,00000000), ref: 006C45E1
Part of subcall function 006C45C9: GetLastError.KERNEL32(?,0068F49C,?,00000080,?,00000000,?,00690458,?,?), ref: 006C45EE

Strings

Failed to allocate regid file path., xrefs: 0068F4DD
Failed to create regid folder: %ls, xrefs: 0068F4CD
Failed to format tag folder path., xrefs: 0068F4EB
Failed to write tag xml to file: %ls, xrefs: 0068F4C3
Failed to allocate regid folder path., xrefs: 0068F4E4
swidtag, xrefs: 0068F445

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
API String ID: 904508749-1201533908
Opcode ID: 12bbd4e36140c677ba8309ebdd650ceb2897f9e223dff5d9719d2ca6f2f43e47
Instruction ID: e625bf76ea8f6fbf135150174b503ad17e3b73aca528d7d749dae173bb594e41
Opcode Fuzzy Hash: 12bbd4e36140c677ba8309ebdd650ceb2897f9e223dff5d9719d2ca6f2f43e47
Instruction Fuzzy Hash: 8B317E71D00219BBCB51BFA4DC41B9EBBB6EF04710F20827BF914AA252D7B19A509B94

Function 00695365 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 0069540E
GetLastError.KERNEL32(?,?,?,00684CA6,?,?,00000000), ref: 00695419

Strings

Failed to write restart to message buffer., xrefs: 006953B1
Failed to write exit code to message buffer., xrefs: 00695389
Failed to post terminate message to child process cache thread., xrefs: 006953DD
Failed to wait for child process exit., xrefs: 00695447
Failed to post terminate message to child process., xrefs: 006953F9
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 0069543D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1211598281-389050287
Opcode ID: efb715cf6f3e4e6c754648666ed0863970dbb2c6790f1911151733b957ef299d
Instruction ID: 40b226bc7ee134e35bb91c4f2e4a749b315498a29b64ac0a29baf8836c614989
Opcode Fuzzy Hash: efb715cf6f3e4e6c754648666ed0863970dbb2c6790f1911151733b957ef299d
Instruction Fuzzy Hash: D021F572940A29BBCF135B948C01EDE77AFAF00765F110216F901BA690E770AE8197D5

Function 00698F6B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,?,?,00699DDA,00000003,000007D0,?,000007D0,00000000), ref: 00698F85
GetLastError.KERNEL32(?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?,?), ref: 00698F92
CloseHandle.KERNEL32(00000000,?,00699DDA,00000003,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?,?,?), ref: 0069905A

Strings

Failed to open payload at path: %ls, xrefs: 00698FD6
Failed to verify signature of payload: %ls, xrefs: 00699002
Failed to verify catalog signature of payload: %ls, xrefs: 00699021
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00698FC9
Failed to verify hash of payload: %ls, xrefs: 00699045

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2528220319-1480445316
Opcode ID: d6c6e4e6cf2dfb40ff91153cd34b740db65e9d7fb4ed7cc4c68a44111b4615f2
Instruction ID: c175d537ce067c6e9bb3ec190ceee7136dee51ffa0c249df7f0c630533b8525f
Opcode Fuzzy Hash: d6c6e4e6cf2dfb40ff91153cd34b740db65e9d7fb4ed7cc4c68a44111b4615f2
Instruction Fuzzy Hash: 0D212632A40529B7CF321669CC45FAA3B1FBF00774F11421DFD2066AA0E3658C60DAE1

Function 00686B30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00686B7B
GetLastError.KERNEL32 ref: 00686B85
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00686BC9
GetLastError.KERNEL32 ref: 00686BD3

Strings

Failed to get windows directory., xrefs: 00686BB3
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00686BA9, 00686BF7
Failed to get volume path name., xrefs: 00686C01
Failed to set variant value., xrefs: 00686C1D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 124030351-26183806
Opcode ID: 988fb587ca70b077166521a9e233f8b793fbdf5f1ab25d2aca445c2f22177463
Instruction ID: 04ce95bb98ef362373d7bf274901368807684ac75663ded7c307c8b3d86b991a
Opcode Fuzzy Hash: 988fb587ca70b077166521a9e233f8b793fbdf5f1ab25d2aca445c2f22177463
Instruction Fuzzy Hash: D02107B7E0123967D720B6948C06FDA76AEDB04B14F114269FD05F7241EA78AD0087E9

Function 00689C2D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00689C46
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000000B8,00000100,00000000,?,0068A86A,00000100,000000B8,000000B8,?,000000B8,00000100), ref: 00689C5E
GetLastError.KERNEL32(?,0068A86A,00000100,000000B8,000000B8,?,000000B8,00000100,000000B8,000002C0,00000100), ref: 00689C6B

Strings

Failed get to file attributes. '%ls', xrefs: 00689CA8
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 00689C9B
Failed to format variable string., xrefs: 00689C51
Failed to set variable., xrefs: 00689CF4
File search: %ls, did not find path: %ls, xrefs: 00689CBD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1811509786-3902182656
Opcode ID: 6326b75f8a4ed3cb4783155a4f766f63259ddd5af7689e387b019ccf53809bbf
Instruction ID: e97c35f426e01eea7068acac9466a9d04d8971075c876292de2352526cb4d0e6
Opcode Fuzzy Hash: 6326b75f8a4ed3cb4783155a4f766f63259ddd5af7689e387b019ccf53809bbf
Instruction Fuzzy Hash: EF210732A40121BBDB1176A49D06FBEBA67AF00720F194328FD01B6290D6729D0097E5

Function 0069AC12 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0069AC29
GetLastError.KERNEL32 ref: 0069AC33
CoInitializeEx.OLE32(00000000,00000000), ref: 0069AC72
CoUninitialize.OLE32(?,0069C5CA,?,?), ref: 0069ACAF

Strings

Failed to pump messages in child process., xrefs: 0069AC9D
Failed to set elevated cache pipe into thread local storage for logging., xrefs: 0069AC61
Failed to initialize COM., xrefs: 0069AC7E
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0069AC57

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 876858697-588708458
Opcode ID: e70e4f8e8ce41ad2ba018e35b9aea525711917ede2511803373d1907d4d2a1fd
Instruction ID: bbcab17a81e06225c0812123ef8af58e515e6cca0ac2c9fca6a2895fe6c1382e
Opcode Fuzzy Hash: e70e4f8e8ce41ad2ba018e35b9aea525711917ede2511803373d1907d4d2a1fd
Instruction Fuzzy Hash: A811E372941635BB8B1127E49C09DAABFAFEF00B607120219FC01BB650E660AD0086D6

Function 00685D14 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00685D9A

Part of subcall function 006C095E: RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,00000000,00000088,000000B8,00000088,00000002,000000B8,BundleUpgradeCode,000002C0,00000088,000000B8,00000000), ref: 006C09D4
Part of subcall function 006C095E: RegQueryValueExW.ADVAPI32(?,00000088,00000000,?,00000088,00000088,00000088,?), ref: 006C0A0C

Strings

Failed to read folder path for '%ls'., xrefs: 00685D66
Failed to open Windows folder key., xrefs: 00685D4C
+, xrefs: 00685D1C
ProgramFilesDir, xrefs: 00685D29
Failed to ensure path was backslash terminated., xrefs: 00685D84
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00685D37
CommonFilesDir, xrefs: 00685D22, 00685D56, 00685D65

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: 65c34e08285ce175aed9775a2d626c69a6ce0f8bff16029f040e1c9cd934a17c
Instruction ID: 0e422f9088fcab71cd6d30fb98e1f32e70c162f93eda3fb9dce9d0868ae6a77b
Opcode Fuzzy Hash: 65c34e08285ce175aed9775a2d626c69a6ce0f8bff16029f040e1c9cd934a17c
Instruction Fuzzy Hash: 6401B932941524B7CB117A94ED1AFAE766BDF41770F11421DFC0976250D6709E01D3D8

Function 00693F22 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00693A2C: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00693F3C,?,?,00000000,?,?,?,00684B57), ref: 00693ACD

Sleep.KERNEL32(000007D0,?,?,00000000,?,?,?,00684B57,?,?,?,?,?,00000000,00000001), ref: 00693FD3

Strings

log, xrefs: 00693F7A
Failed to copy log extension to extension., xrefs: 0069411E
Failed to get non-session specific TEMP folder., xrefs: 00694081
Failed to get current directory., xrefs: 00693FB5
Setup, xrefs: 00693F80
Failed to open log: %ls, xrefs: 0069404B
Failed to copy log path to prefix., xrefs: 006940FB
Failed to copy full log path to prefix., xrefs: 0069413C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$log
API String ID: 2834455192-2818506709
Opcode ID: 7f9025c03ac709861a142314bbd55f4810796c8d7c17c32bc071b6182524b761
Instruction ID: 3b6b0e09f7999aaed05802ebe9eb0566e0382c69647bc85d2eb37c2b0d3a6173
Opcode Fuzzy Hash: 7f9025c03ac709861a142314bbd55f4810796c8d7c17c32bc071b6182524b761
Instruction Fuzzy Hash: 7361A271A00226AEDF559F64CC42EBA77BFEF10340B154629F801DBB50EB70EE5187A1

Function 006B9A87 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,t,k,006B2C74,?,?,?,006B9CD8,00000001,00000001,BCE85006), ref: 006B9AE1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,006B9CD8,00000001,00000001,BCE85006,?,?,?), ref: 006B9B67
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,BCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006B9C61
__freea.LIBCMT ref: 006B9C6E

Part of subcall function 006B5D22: RtlAllocateHeap.NTDLL(00000000,?,?,?,006B1782,?,0000015D,?,?,?,?,006B2BDB,000000FF,00000000,?,?), ref: 006B5D54

__freea.LIBCMT ref: 006B9C77
__freea.LIBCMT ref: 006B9C9C

Strings

t,k, xrefs: 006B9A99

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID: t,k
API String ID: 1414292761-1340656352
Opcode ID: c85625d0e0033c1570e3481b58f8d055b0e56b4a56081f461da6d9e47ffff077
Instruction ID: 284ceb9a0712d1cafecf4d784eeac58188bbf5da970117f1618a8ca4c564409e
Opcode Fuzzy Hash: c85625d0e0033c1570e3481b58f8d055b0e56b4a56081f461da6d9e47ffff077
Instruction Fuzzy Hash: 03519EB2600216ABEB258F64CC85EFB7BABEB44750F154628FA05D7240EB34DC90D774

Function 006A9FA3 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,00000000,?), ref: 006AA070
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 006AA07A

Strings

Failed attempt to download URL: '%ls' to: '%ls', xrefs: 006AA157
Failed to clear readonly bit on payload destination path: %ls, xrefs: 006AA0A9
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 006AA09E
download, xrefs: 006AA03A
:, xrefs: 006AA0F3

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$download
API String ID: 1799206407-2514864748
Opcode ID: a14fb1763045dda3752d34f523a4e890c095507c0f5a3f8a767dfd1af25662ab
Instruction ID: 11f27721eba9c3a9a804c24625aa1b516e8a698537197b8075cf43675f532774
Opcode Fuzzy Hash: a14fb1763045dda3752d34f523a4e890c095507c0f5a3f8a767dfd1af25662ab
Instruction Fuzzy Hash: 0D51AE71A00219AFDB11EFA8C881AEEB7B6BF15714F10845AE805EB351E375DE40CFA1

Function 006C7C88 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,000002C0,?,?,006A8D9E,000000B8,00000001), ref: 006C7CB6
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,006A8D9E,000000B8,00000001,00000000,000000B8,00000001,000000B8,000002C0), ref: 006C7CD1

Strings

c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 006C7D6C
http://appsyndication.org/2006/appsyn, xrefs: 006C7CA9
type, xrefs: 006C7CF8
application, xrefs: 006C7CC3

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-536847345
Opcode ID: 90290a23e9b73f24cc2752a9600399a60de174494552957ca4ffb08fd24825a5
Instruction ID: d2515c8244e0071539e0fcdcc0bf11c5aa15ba09ed60ef41112d185a933814cf
Opcode Fuzzy Hash: 90290a23e9b73f24cc2752a9600399a60de174494552957ca4ffb08fd24825a5
Instruction Fuzzy Hash: 4651AD31608302ABEB209E55CC86F7A77A7EF04760F20865CFA26AB3D5D670ED408F54

Function 006C5C9E Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006C5CFA
DeleteFileW.KERNEL32(000002C0,00000000,00000000,?,?,00000078,000000FF,000002C0,?,?,?,00000078,000000FF,?,?,00000078), ref: 006C5DF1
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,000002C0,?,?,?,00000078,000000FF,?,?,00000078), ref: 006C5E00

Strings

Burn, xrefs: 006C5CE9
c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 006C5D1E
WiX\Burn, xrefs: 006C5D38
DownloadTimeout, xrefs: 006C5D33

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3522763407-1474791565
Opcode ID: 0b31bba8daba53e0e95419f08082db446b02a43bef09621dc813a1f7ab0415e4
Instruction ID: 600cd8b05afa56f11bd2185b45a547e67b19a765fb5143b5338be9ad46903dd7
Opcode Fuzzy Hash: 0b31bba8daba53e0e95419f08082db446b02a43bef09621dc813a1f7ab0415e4
Instruction Fuzzy Hash: 9B514B72D00619AFDB119FE4CC45EFFBBBAEF08710F01415AFA11E6150E730AA509BA0

Function 00699158 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 006991E6

Part of subcall function 006C4ED0: GetLastError.KERNEL32(?,?,0069920B,00000003,00000003,?,?), ref: 006C4EEF

_memcmp.LIBVCRUNTIME ref: 00699220
GetLastError.KERNEL32 ref: 00699298

Strings

Failed to read certificate thumbprint., xrefs: 0069928C
Failed to get certificate public key identifier., xrefs: 006992C6
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 006992BC
Failed to find expected public key in certificate chain., xrefs: 0069925B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3038490147
Opcode ID: 689c6e4a5341d542084ac42d4800b019c759630553e8289879421b96889c92fa
Instruction ID: 71dedb2575c8989b4b86fe56f1ed1e5fa988c4c4275f9ff7d3850a84188ae690
Opcode Fuzzy Hash: 689c6e4a5341d542084ac42d4800b019c759630553e8289879421b96889c92fa
Instruction Fuzzy Hash: 92414C72E10215ABDF10DBA9C841EEEB7BAAF08714F11412AF905FB741D674EE01CBA4

Function 00690539 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00000000,00000001,00020006,?,?,00000001,00000000,?), ref: 0069066A
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00000000,00000001,00020006,?,?,00000001,00000000,?), ref: 00690679

Part of subcall function 006C04A5: RegCreateKeyExW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,006905B1,00000000,00000000,00020006), ref: 006C04CA

Strings

Failed to update resume mode., xrefs: 0069064E
Failed to write volatile reboot required registry key., xrefs: 006905B5
Failed to open registration key., xrefs: 006906AF
%ls.RebootRequired, xrefs: 00690587
Failed to delete registration key: %ls, xrefs: 00690618

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: bf60d4f90d350f3a0599e343185bdf230cc35677e076df208de5206e40008aff
Instruction ID: d468f210a7748933e86a3046e37f9cbf1386820fe0442c7cf0ba1021e1f88ff6
Opcode Fuzzy Hash: bf60d4f90d350f3a0599e343185bdf230cc35677e076df208de5206e40008aff
Instruction Fuzzy Hash: 1D415C32900214FEEF62AFA0CD06EAE7BBBAF80314F10402EF941A1561D7719A60DB55

Function 0068F7B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0068F8E4
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0068F8F1

Strings

Failed to format pending restart registry key to read., xrefs: 0068F7E8
Failed to open registration key., xrefs: 0068F84D
%ls.RebootRequired, xrefs: 0068F7D1
Failed to read Resume value., xrefs: 0068F87A
Resume, xrefs: 0068F858

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 6b28375155a0e0371504834e551f46de55c144aa09e45779aa007ad6d6785ed3
Instruction ID: f7478afb8a46579fc8a5d225e686038c3225d16081952632f8a20daef6b79e1c
Opcode Fuzzy Hash: 6b28375155a0e0371504834e551f46de55c144aa09e45779aa007ad6d6785ed3
Instruction Fuzzy Hash: 63414FB1D00119EFDB11BF98C941AADBBB6FF04310F15827BE915AB350D3B19E509B91

Function 0069A8DD Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

WixBundleLastUsedSource, xrefs: 0069A97C, 0069A982, 0069A9BE
Failed to trim source folder., xrefs: 0069A972
Failed to set last source., xrefs: 0069A9CD
Failed to determine length of source path., xrefs: 0069A90D
Failed to determine length of relative path., xrefs: 0069A92A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: c6c679839b9ec0a46307224ab5dab443785a61311424b20701eea11bbe50c6dd
Instruction ID: bde23a8e8fec3e6b0ae4be9a6e15e0b8abf0916ba020257a74f1d40baa9dd741
Opcode Fuzzy Hash: c6c679839b9ec0a46307224ab5dab443785a61311424b20701eea11bbe50c6dd
Instruction Fuzzy Hash: C831A532D10229BBCF219AE4CC41EAE7AAFBB40720F220356F511BA690D6709E51D7D1

Function 006AD572 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(006E01A0,00000000,00000017,006E01B0,?,?,00000000,00000000,?,?,?,?,?,006ADB99,00000000,00000000), ref: 006AD5AA

Strings

Failed to set progress timeout., xrefs: 006AD614
Failed to create IBackgroundCopyManager., xrefs: 006AD5B6
Failed to create BITS job., xrefs: 006AD5E4
Failed to set notification flags for BITS job., xrefs: 006AD5FC
WixBurn, xrefs: 006AD5D5
Failed to set BITS job to foreground., xrefs: 006AD62B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: 9d3c4e2f956ee6fd083d7d899de2441ac7d064e6c28a6ca17e2c50fb5f08d53e
Instruction ID: fa8b63740f1f8e1589d00b44dc85b871aeafe8d369304c6d4bcc5b46f66eedae
Opcode Fuzzy Hash: 9d3c4e2f956ee6fd083d7d899de2441ac7d064e6c28a6ca17e2c50fb5f08d53e
Instruction Fuzzy Hash: 8531D631E01315AFD715DBA9C895EAFBBF6AF4A704B114058F906EB390D670ED42CB90

Function 006C559F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 006C55E9
GetLastError.KERNEL32 ref: 006C55F6
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 006C563D
GetLastError.KERNEL32 ref: 006C5671
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 006C56A5

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 006C561A, 006C5695
%ls.R, xrefs: 006C55BD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-260802336
Opcode ID: ea788835f4f5eab719ef5adb042858487d6b34cdf1759ed94333443c6bb6c36f
Instruction ID: 0e373f7a3cd75d3ca14ec8402090fb28eeb72bd91a28bc6a7d61cb1a392dbfe7
Opcode Fuzzy Hash: ea788835f4f5eab719ef5adb042858487d6b34cdf1759ed94333443c6bb6c36f
Instruction Fuzzy Hash: A9312B72A41625AFD7208B55CC45FBE7AA6EF01764F11421DFE02EF2E0D770AC4087A5

Function 0068C8A5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0068CD19: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,0068E3ED,000000FF,00000000,00000000,0068E3ED,?,?,0068DB97,?,?,?,?), ref: 0068CD44

CreateFileW.KERNEL32(E9006CAA,80000000,00000005,00000000,00000003,08000000,00000000,00685402,?,00000000,840F01E8,E0680A79,00000001,006853FA,00000000,006854C6), ref: 0068C915
GetLastError.KERNEL32(?,?,?,006976FC,006856AA,006854B6,006854B6,00000000,?,006854C6,FFF9E89D,006854C6,006854FA,00685482,?,00685482), ref: 0068C95A

Strings

Failed to get catalog local file path, xrefs: 0068C998
c:\agent\_work\66\s\src\burn\engine\catalog.cpp, xrefs: 0068C97B
Failed to open catalog in working path: %ls, xrefs: 0068C988
Failed to verify catalog signature: %ls, xrefs: 0068C953
Failed to find payload for catalog file., xrefs: 0068C99F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$c:\agent\_work\66\s\src\burn\engine\catalog.cpp
API String ID: 1774366664-749786727
Opcode ID: cb99d65010263a7460b2c4fb6f4ddbe979d7e82ab572ec88d27ec0a118d700e3
Instruction ID: b8a510ce98378c662fe6275450130bb9a9ebc69866236e86a2248a0f4e5aa11d
Opcode Fuzzy Hash: cb99d65010263a7460b2c4fb6f4ddbe979d7e82ab572ec88d27ec0a118d700e3
Instruction Fuzzy Hash: 7E31D872940625BFDB11ABA4CC01FADBBB6EF04760F114359F905BB290E671ED5087E4

Function 006C0201 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 006C0271
GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 006C027B
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 006C02C4
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 006C02D1

Strings

D, xrefs: 006C0259
"%ls" %ls, xrefs: 006C023A
c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 006C029F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 161867955-1799623275
Opcode ID: 3b8016fc1f314597d8f4971fafc59bbb5be874299cf0f0f306450fcbf9b244fa
Instruction ID: 141d634eb82fe849118a52354bc516e9c760a314bdea07e5472a8ac2b60e4131
Opcode Fuzzy Hash: 3b8016fc1f314597d8f4971fafc59bbb5be874299cf0f0f306450fcbf9b244fa
Instruction Fuzzy Hash: E421507190021EEBEB11DFE4DD45EEEBB7AEF04754F100129EA01B7210E2749E008BA1

Function 006AD016 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,006AD312,?), ref: 006AD035
ReleaseMutex.KERNEL32(?,?,?,006AD312,?), ref: 006AD049
WaitForSingleObject.KERNEL32(?,000000FF), ref: 006AD08E
ReleaseMutex.KERNEL32(?), ref: 006AD0A1
SetEvent.KERNEL32(?), ref: 006AD0AA

Strings

Failed to get message from netfx chainer., xrefs: 006AD0CB
Failed to send files in use message from netfx chainer., xrefs: 006AD0EE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: c280045aa7dca261d56d9230581a9ac66547bd365596bae7a34099c09c3cbd0a
Instruction ID: cc7c001f075bacbc21ef045e8c1b3533c56ab8ac70a7fb174d340c7f7b31c356
Opcode Fuzzy Hash: c280045aa7dca261d56d9230581a9ac66547bd365596bae7a34099c09c3cbd0a
Instruction Fuzzy Hash: 2831C87290061ABFCB019FA4CC45EEDBBBABF06324F148266F511A6651C774DE518B90

Function 00689B5C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00689B75
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000000B8,00000100,00000000,?,0068A880,00000100,000000B8,000002C0,00000100), ref: 00689B95
GetLastError.KERNEL32(?,0068A880,00000100,000000B8,000002C0,00000100), ref: 00689BA0

Strings

Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00689C0C
Failed to set directory search path variable., xrefs: 00689BD1
Failed while searching directory search: %ls, for path: %ls, xrefs: 00689BF6
Failed to format variable string., xrefs: 00689B80

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: 4c715261e66ea912d3603c2ef4ddb7b169596eca67ed3b115c90fae65474b225
Instruction ID: 16a01522e66650d5e8c180dcb0428c6431d3b274db413d5414573f9de40df2ef
Opcode Fuzzy Hash: 4c715261e66ea912d3603c2ef4ddb7b169596eca67ed3b115c90fae65474b225
Instruction Fuzzy Hash: 18110873941125BBCB123A989D02FBEBA67DF00320F290369F800766A1D7669D50E7E5

Function 00689D11 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00689D2A
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000000B8,00000100,00000000,?,0068A858,00000100,000000B8,000000B8,?,000000B8,00000100), ref: 00689D4A
GetLastError.KERNEL32(?,0068A858,00000100,000000B8,000000B8,?,000000B8,00000100,000000B8,000002C0,00000100), ref: 00689D55

Strings

Failed while searching file search: %ls, for path: %ls, xrefs: 00689D83
Failed to format variable string., xrefs: 00689D35
File search: %ls, did not find path: %ls, xrefs: 00689DB9
Failed to set variable to file search path., xrefs: 00689DAD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 76126ba73b08cbfbbb360b6839311e1aaed49aadbc38af161c352c6e9d28dfe4
Instruction ID: 88ce9e91ee290391659555220ec0c55ad8e8361fda9fdcc1bea8b76bbbb09f77
Opcode Fuzzy Hash: 76126ba73b08cbfbbb360b6839311e1aaed49aadbc38af161c352c6e9d28dfe4
Instruction Fuzzy Hash: 6811A537940925BBCB2276A4CD02FFDBA27AF11724F250325F900B62A1D7619E50A7E9

Function 00689A0E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00689A85

Strings

Failed to select condition node., xrefs: 00689A3C
Condition, xrefs: 00689A20
BTh, xrefs: 00689A0E
Failed to get Condition inner text., xrefs: 00689A55
Failed to copy condition string from BSTR, xrefs: 00689A6F
`)u, xrefs: 00689A85

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeString
String ID: BTh$Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`)u
API String ID: 3341692771-3853150593
Opcode ID: 13e23441a2663392496486bda62a71bbb3b344c97501208e8c246cee72a338d3
Instruction ID: 95f9d4d74102c3c0953202d468aaf26a0b0e7496aeb4fc7d05beb0b62f88bcc7
Opcode Fuzzy Hash: 13e23441a2663392496486bda62a71bbb3b344c97501208e8c246cee72a338d3
Instruction Fuzzy Hash: 29118231940228BBDB19B7A0CC16FBD7B76DF00720F150269F802B6254D771AE40D7A4

Function 0069CDC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,0069D1EC,00000000,?,?,0069C672,?,?), ref: 0069CDDA
GetLastError.KERNEL32(?,?,0069D1EC,00000000,?,?,0069C672,?,?), ref: 0069CDE4
GetExitCodeThread.KERNEL32(?,?,?,?,0069D1EC,00000000,?,?,0069C672,?,?), ref: 0069CE20
GetLastError.KERNEL32(?,?,0069D1EC,00000000,?,?,0069C672,?,?), ref: 0069CE2A

Strings

Failed to wait for cache thread to terminate., xrefs: 0069CE12
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0069CE08, 0069CE4E
Failed to get cache thread exit code., xrefs: 0069CE58

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3686190907-1009398494
Opcode ID: 15331f3371f42c1bac01343bb95db2fb18ab1d5733aa2b69d565a55272ddae25
Instruction ID: c1f49060aa24f420b15f1d5c2bd4af07c8aaab39c56dd5a17c328dcaf12c8c2d
Opcode Fuzzy Hash: 15331f3371f42c1bac01343bb95db2fb18ab1d5733aa2b69d565a55272ddae25
Instruction Fuzzy Hash: 4A01F9B3E5163567DB2057948D0AE9B7A5FAF00BB1B020125FE02FB780E768DD0082D9

Function 006968AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,00696DE9,?,?,00000000,?,?,00000001,00000000), ref: 006968BB
GetLastError.KERNEL32(?,00696DE9,?,?,00000000,?,?,00000001,00000000), ref: 006968C5
GetExitCodeThread.KERNEL32(?,00000000,?,00696DE9,?,?,00000000,?,?,00000001,00000000), ref: 00696904
GetLastError.KERNEL32(?,00696DE9,?,?,00000000,?,?,00000001,00000000), ref: 0069690E

Strings

Failed to wait for cache thread to terminate., xrefs: 006968F6
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 006968EC, 00696935
Failed to get cache thread exit code., xrefs: 0069693F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 3686190907-4004332966
Opcode ID: becc571aa119bb5e86759205c8e05c4cf11c1e89fa4e8491e5fcc90e704580b7
Instruction ID: 119ef9d026739bfe023e3111b035a51c891a070766be42983c714cd231487c84
Opcode Fuzzy Hash: becc571aa119bb5e86759205c8e05c4cf11c1e89fa4e8491e5fcc90e704580b7
Instruction Fuzzy Hash: 6E11697074031BBBEB009F60DE05F7A36AF9B00755F104169B904E9290EB79CB409768

Function 0069AA79 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,000000FF,?,?,00000003,00000000,00000000), ref: 0069AB6A
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,?,?,00000003,00000000,00000000), ref: 0069ABAE

Part of subcall function 00699158: _memcmp.LIBVCRUNTIME ref: 006991E6
Part of subcall function 00699158: _memcmp.LIBVCRUNTIME ref: 00699220

Strings

Failed to get signer chain from authenticode certificate., xrefs: 0069ABDC
Failed to get provider state from authenticode certificate., xrefs: 0069AB98
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 0069AB40, 0069AB8E, 0069ABD2
0, xrefs: 0069AAE6
Failed authenticode verification of payload: %ls, xrefs: 0069AB4B
Failed to verify expected payload against actual certificate chain., xrefs: 0069ABF2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: 0$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3510382728
Opcode ID: 67efb54e1ed2770bcffb15050f3ff06fc508d734d1f680582c7179577b4bd3f5
Instruction ID: 908df230d27d0826327da8359b38519ae4b49c6372f525f956428ff296fcf497
Opcode Fuzzy Hash: 67efb54e1ed2770bcffb15050f3ff06fc508d734d1f680582c7179577b4bd3f5
Instruction Fuzzy Hash: 104173B6D01229ABDB11DBD8CD45ADEBBBAAF04710F11022EF901BB340D7749D458BE5

Function 0069F618 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0069F62D
LeaveCriticalSection.KERNEL32(?), ref: 0069F73A

Strings

UX requested unknown container with id: %ls, xrefs: 0069F6F9
Engine is active, cannot change engine state., xrefs: 0069F647
UX requested unknown payload with id: %ls, xrefs: 0069F699
Failed to set source path for payload., xrefs: 0069F6C9
UX denied while trying to set source on embedded payload: %ls, xrefs: 0069F6AF
Failed to set source path for container., xrefs: 0069F71F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: c1648068df3a871cb41ce73f68b039edd7f27833332f3447a8e740de3d96ea37
Instruction ID: 074db1215b2ff3e82bb644c561966cd5246f2be29f206cd65d7b7798a1706472
Opcode Fuzzy Hash: c1648068df3a871cb41ce73f68b039edd7f27833332f3447a8e740de3d96ea37
Instruction Fuzzy Hash: D0310576A00211BBCF619BA8EC45D9A77AE9F15720B17413AF804EB750DBB4ED01C3A4

Function 0068720A Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0068721D

Strings

[]{}, xrefs: 00687247
Failed to allocate buffer for escaped string., xrefs: 00687234
[\%c], xrefs: 0068727C
Failed to copy string., xrefs: 006872D1
Failed to append escape sequence., xrefs: 006872B0
Failed to append characters., xrefs: 006872A9
Failed to format escape sequence., xrefs: 006872B7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: 0683f7c64855db64ab977153aca4157373900f04267d17ff95c6ea5556555621
Instruction ID: 3953ec06fae15f3c4c312fac7679f619c96cfb79aa7cfb9662af2e0f7d80268d
Opcode Fuzzy Hash: 0683f7c64855db64ab977153aca4157373900f04267d17ff95c6ea5556555621
Instruction Fuzzy Hash: 3F21E972D08219FACB2176948C62FEE77ABDF11764F31021AF90076150DB74EF019398

Function 006BC3AD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,006BCB22,00000000,00000000,00000000,00000000,00000000,006B2718), ref: 006BC3EF
__fassign.LIBCMT ref: 006BC46A
__fassign.LIBCMT ref: 006BC485
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 006BC4AB
WriteFile.KERNEL32(?,00000000,00000000,006BCB22,00000000,?,?,?,?,?,?,?,?,?,006BCB22,00000000), ref: 006BC4CA
WriteFile.KERNEL32(?,00000000,00000001,006BCB22,00000000,?,?,?,?,?,?,?,?,?,006BCB22,00000000), ref: 006BC503

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ecc7b757701c8e7b119d3a034a66d25b56a8f67f8b71d1c4f4ea7adea64f96ce
Instruction ID: 6fcb36052f44cfbd1ab94dc7adacba6191c28bcb2d0d4465637ebdb634ee0764
Opcode Fuzzy Hash: ecc7b757701c8e7b119d3a034a66d25b56a8f67f8b71d1c4f4ea7adea64f96ce
Instruction Fuzzy Hash: 5651F6F19002499FDB10CFA8DC81AEEBBFAFF09310F14415AE551E7251E730AA91CB61

Function 0069D2BA Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,?,?,00000001,000000FF,?,?,?,?,00000001,00000000,?,006973D9), ref: 0069D3E3

Strings

Failed to connect to elevated child process., xrefs: 0069D3CC
Failed to create pipe and cache pipe., xrefs: 0069D340
Failed to create pipe name and client token., xrefs: 0069D324
UX aborted elevation requirement., xrefs: 0069D2F8
Failed to elevate., xrefs: 0069D3C5
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0069D2EE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 2962429428-2367031576
Opcode ID: ef012c9d00d9efa5de59d29aab9c8bf89d1fef2ad8d91b2dc269f47849b1a089
Instruction ID: dc2c09d43d1f5b6b76e50917170187a97bcbc24f1ebfe6a0d353dcec7cd57ef4
Opcode Fuzzy Hash: ef012c9d00d9efa5de59d29aab9c8bf89d1fef2ad8d91b2dc269f47849b1a089
Instruction Fuzzy Hash: C1313E72A44721BBEF156770DC42FAA675FAF01721F10032AF905F66C1DAA0AD4047EA

Function 006BFDEF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006EB5D4,00000000,?,?,?,0069409F,00000001,?,00000000,?,00000000,00000000,?,00000001,?,?), ref: 006BFDFF
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,00000001,00000000,00000001,?,?,0069409F,00000001,?,00000000,?), ref: 006BFEA3
GetLastError.KERNEL32(?,?,0069409F,00000001,?,00000000,?,00000000,00000000,?,00000001,?,?,00000000,?), ref: 006BFEB3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,0069409F,00000001,?,00000000,?,00000000,00000000,?,00000001,?), ref: 006BFEED

Part of subcall function 00682EBC: GetLocalTime.KERNEL32(?,?,?), ref: 00683006

LeaveCriticalSection.KERNEL32(006EB5D4,?,?,0069409F,00000001,?,00000000,?,00000000,00000000,?,00000001,?,?,00000000,?), ref: 006BFF46

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 006BFED2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-727082060
Opcode ID: 22683a4a816c77a8320fa80ee9d3d19e613422018411ba8a8f847c34fff6c842
Instruction ID: c61af1ffc686cbe85f6b2ae699bb819355eaaf0dbd9f529318a7349c9161430b
Opcode Fuzzy Hash: 22683a4a816c77a8320fa80ee9d3d19e613422018411ba8a8f847c34fff6c842
Instruction Fuzzy Hash: 5F31B6B190136ABFDB11AFA09D95EFB3A6BEB00754B055639F900AA271C731CD909F90

Function 006A3727 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 111COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A378E

Strings

Failed to format property string part., xrefs: 006A3809
%s%="%s", xrefs: 006A37C1
Failed to format property value., xrefs: 006A3817
Failed to escape string., xrefs: 006A3810
Failed to append property string part., xrefs: 006A3802

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: 00341305b85ac430d2be7b94029dedd5821dc4ba51276761bc2c0d7f320d5983
Instruction ID: cde60dc6efb232ad8b0d99d357bcb552f1c47684e28e56bde30a17ede2753936
Opcode Fuzzy Hash: 00341305b85ac430d2be7b94029dedd5821dc4ba51276761bc2c0d7f320d5983
Instruction Fuzzy Hash: 2F31CEB1D0422AEFCB15BE94CC01A9EB77AAF01B10F11426AF81162351E770EF50CF98

Function 0069D0E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0069AC12,?,00000000,00000000), ref: 0069D170
GetLastError.KERNEL32 ref: 0069D17C

Part of subcall function 0069CDC8: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,0069D1EC,00000000,?,?,0069C672,?,?), ref: 0069CDDA
Part of subcall function 0069CDC8: GetLastError.KERNEL32(?,?,0069D1EC,00000000,?,?,0069C672,?,?), ref: 0069CDE4

CloseHandle.KERNEL32(00000000,00000000,?,?,0069C672,?,?), ref: 0069D1FD

Strings

Failed to pump messages in child process., xrefs: 0069D1D4
Failed to create elevated cache thread., xrefs: 0069D1AA
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0069D1A0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3606931770-2334070456
Opcode ID: 1484799029201387064f305800c2e740e741ca123360b9326f67f866dd33b412
Instruction ID: 1b29b7254d762a75bb1b860fffde3d88261935b279c61b385668099dc6e8b363
Opcode Fuzzy Hash: 1484799029201387064f305800c2e740e741ca123360b9326f67f866dd33b412
Instruction Fuzzy Hash: 9541C8B6D01229AF8B45DFA8D9819EEBBFAFF08750F11412AF904E7340E77499418F94

Function 006C71DB Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

SysFreeString.OLEAUT32(00000000), ref: 006C72BE
SysFreeString.OLEAUT32(?), ref: 006C72C9
SysFreeString.OLEAUT32(00000000), ref: 006C72D4

Strings

sl, xrefs: 006C72D1, 006C7272, 006C7296, 006C7284
`)u, xrefs: 006C72B3
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 006C7208

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$sl
API String ID: 2724874077-1915524777
Opcode ID: fa3bac6fdebfdeb0b32aeee3448ea8553da026d3533254ec73d01fb61878c1f5
Instruction ID: ea66abe5d3c86b0fb87a354c7e8fc666fa3271493345c805e8b47ad5e877c84c
Opcode Fuzzy Hash: fa3bac6fdebfdeb0b32aeee3448ea8553da026d3533254ec73d01fb61878c1f5
Instruction Fuzzy Hash: E631B231D0422AABDB12AB95C855FAEBB7AEF40720F114259F900BB240D774EF058F90

Function 00687337 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00685966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00687349
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00685966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00687428

Strings

Failed to get unformatted string., xrefs: 006873B9
Failed to get variable: %ls, xrefs: 0068738A
Failed to format value '%ls' of variable: %ls, xrefs: 006873F2
*****, xrefs: 006873E4, 006873F1
Failed to get value as string for variable: %ls, xrefs: 00687417

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 8f2f7a78c7928c9de9d913b29ce4a952e3ce62f9b73696100abb8edd7267c136
Instruction ID: a5c318695322e88ae568a4bc7f8dc27b084b2c335139dad3f30276108d35f9fc
Opcode Fuzzy Hash: 8f2f7a78c7928c9de9d913b29ce4a952e3ce62f9b73696100abb8edd7267c136
Instruction Fuzzy Hash: 4431A132904519BBCF127E60CC06FAEBBA7EB14325F204269F810A6250D375DAA1DBD5

Function 006C2B5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006C2B73
SysAllocString.OLEAUT32(?), ref: 006C2B8F
VariantClear.OLEAUT32(?), ref: 006C2C16
SysFreeString.OLEAUT32(00000000), ref: 006C2C21

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C2BA6
`)u, xrefs: 006C2C21

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-176205067
Opcode ID: 30cbdbd00d02cc152154eefbc5c3f13f74ac751097b46e1ffb116ef5f13b99df
Instruction ID: b2787d67ddd664f5c854c5569d63053996583c625ee9f79795a4718668df6d06
Opcode Fuzzy Hash: 30cbdbd00d02cc152154eefbc5c3f13f74ac751097b46e1ffb116ef5f13b99df
Instruction Fuzzy Hash: F421823990121AABCB10EF94C858FBE7B7AEF44719F15015CFD05AB210CB309D019B90

Function 006C5100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,006A6879,00000000,?), ref: 006C5116
GetLastError.KERNEL32(?,?,006A6879,00000000,?,?,?,?,?,?,?,?,?,006A6C89,?,?), ref: 006C5124

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,006A6879,00000000,?), ref: 006C515E
GetLastError.KERNEL32(?,?,006A6879,00000000,?,?,?,?,?,?,?,?,?,006A6C89,?,?), ref: 006C5168

Strings

c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp, xrefs: 006C5147, 006C5189
yhj, xrefs: 006C51B6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp$yhj
API String ID: 355237494-2474749888
Opcode ID: 21d26a24a5eeda984d2a6fba4213a124bafff56423999a99082681c3418531a2
Instruction ID: b5ac92e318053e706981266353990bc5f14b525c0c9a5db80a46b57a8b660063
Opcode Fuzzy Hash: 21d26a24a5eeda984d2a6fba4213a124bafff56423999a99082681c3418531a2
Instruction Fuzzy Hash: 81213876A01635B7D7206A858D0DFFB696BDF50BA0F1A011CFD02BB300E764EE4096E5

Function 00698CC3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,?,?,00000000,00000000,?,?,?), ref: 00698D0E
GetLastError.KERNEL32 ref: 00698D18
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00698D78

Strings

Failed to allocate administrator SID., xrefs: 00698CF4
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00698D3C
Failed to initialize ACL., xrefs: 00698D46

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 669721577-4043978521
Opcode ID: 0b2669baf87927b2322a73bdab83a4c2478f97118da68459c852540cd1651e05
Instruction ID: db47cb9254ab20a6ee3f8a75254e563d6ec5ed6b6ddcb80d99401d29b5a024cc
Opcode Fuzzy Hash: 0b2669baf87927b2322a73bdab83a4c2478f97118da68459c852540cd1651e05
Instruction Fuzzy Hash: 8B21D872E40214BBDB215BD59C45FDEB76FAF11B50F11412AF900FB3C0EA749E0456A4

Function 006A0937 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006A0987
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 006A09A6
GetLastError.KERNEL32 ref: 006A09B0

Strings

Failed to write during cabinet extraction., xrefs: 006A09DE
Unexpected call to CabWrite()., xrefs: 006A096A
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A09D4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1970631241-3210721340
Opcode ID: 15a7250fb5bf60543054124c8f15ebf83b829146985848be1d72018dbac5780a
Instruction ID: 0d9d8688eea4223703e12595b5d8a756dc66f8743b6842846a50122bdf085e9b
Opcode Fuzzy Hash: 15a7250fb5bf60543054124c8f15ebf83b829146985848be1d72018dbac5780a
Instruction Fuzzy Hash: 7821D176500205AFEB00EFADDD85D9A77BAFF86714B110159FA04D7352E671DD00CB20

Function 00689A9F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00689AB8
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000000B8,00000100,00000000,?,0068A889,00000100,000000B8,000002C0,00000100), ref: 00689ACD
GetLastError.KERNEL32(?,0068A889,00000100,000000B8,000002C0,00000100), ref: 00689ADA

Strings

Failed while searching directory search: %ls, for path: %ls, xrefs: 00689B1A
Failed to format variable string., xrefs: 00689AC3
Failed to set variable., xrefs: 00689B3F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: 50187f290a0049aca9af6f8c68a5a6209385025c4f378d62fb34cd4230ea8e45
Instruction ID: 4b090dac53e72d267b2b4a8b83d6e21dc06e2dcf6b779744e39e04f3b74aa8d5
Opcode Fuzzy Hash: 50187f290a0049aca9af6f8c68a5a6209385025c4f378d62fb34cd4230ea8e45
Instruction Fuzzy Hash: C1110632A40025BBCF2676A4DD02FFFB667EF00320F254329F801A62A0D7719D40A7E5

Function 006A09FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 006A0A6B
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006A0A7D
SetFileTime.KERNEL32(?,?,?,?), ref: 006A0A90
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,006A0660,?,?), ref: 006A0A9F

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A0A3A
Invalid operation for this state., xrefs: 006A0A44

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 609741386-2444813713
Opcode ID: a350884f88ee318845a27a4be4b99886f100bb5d92d3d188df9822e28158f5a4
Instruction ID: 2e546ba872da8c76fb1dfb62e8cb7bd033994730ea6732f7e5a477ffedd1e97d
Opcode Fuzzy Hash: a350884f88ee318845a27a4be4b99886f100bb5d92d3d188df9822e28158f5a4
Instruction Fuzzy Hash: D321D57290062AAF9710AFA8CC088EA7BAEFF457107148216F551D66D1D375EE11CF90

Function 006B89AF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006B8973: _free.LIBCMT ref: 006B899C

_free.LIBCMT ref: 006B89FD

Part of subcall function 006B5CE8: HeapFree.KERNEL32(00000000,00000000,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?), ref: 006B5CFE
Part of subcall function 006B5CE8: GetLastError.KERNEL32(?,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?,?), ref: 006B5D10

_free.LIBCMT ref: 006B8A08
_free.LIBCMT ref: 006B8A13
_free.LIBCMT ref: 006B8A67
_free.LIBCMT ref: 006B8A72
_free.LIBCMT ref: 006B8A7D
_free.LIBCMT ref: 006B8A88

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction ID: 4ac97e8c25f2836d2c25d6d41c8bd95818fecd5b382732655532ef515a0e3437
Opcode Fuzzy Hash: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction Fuzzy Hash: 3B114FB1640B04AAD9A0BBB4CC07FDB7BDF6F00700F80081EB29A67052DB65B585D79D

Function 006C34C7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006C351B
GetLastError.KERNEL32 ref: 006C3525
CloseHandle.KERNEL32(?), ref: 006C3558

Strings

c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp, xrefs: 006C3546
PDGu, xrefs: 006C351B
<, xrefs: 006C350D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDGu$c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-941709955
Opcode ID: ee9317ce1722d941ccd6b10e9ed89a17ba6181ff3761bd346916b427d112516b
Instruction ID: 3e6cc809e6d16811c3689c143359b957feb3ebdd33ee025f4c197cc92212eea6
Opcode Fuzzy Hash: ee9317ce1722d941ccd6b10e9ed89a17ba6181ff3761bd346916b427d112516b
Instruction Fuzzy Hash: 2321B4B5E01229ABCB10DFA9D944ADEBBF9FF08754F50811AF915E7340E3749A008FA4

Function 006C038A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00685EE0,00000000), ref: 006C039E
GetProcAddress.KERNEL32(00000000), ref: 006C03A5
GetLastError.KERNEL32(?,?,?,00685EE0,00000000), ref: 006C03BC

Strings

kernel32, xrefs: 006C0396
IsWow64Process, xrefs: 006C038F
c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 006C03DD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-3797636953
Opcode ID: 79e81c8cb7cb849233e363f9dc5349a49d1c521da34dc6b5ce11b8e5da0cb480
Instruction ID: 1e3ce5fc3fad4fceb143c66de15b193e74c93292731d0a69e187f7e9121ec946
Opcode Fuzzy Hash: 79e81c8cb7cb849233e363f9dc5349a49d1c521da34dc6b5ce11b8e5da0cb480
Instruction Fuzzy Hash: 33F02872A0077AE797209BD18C09EAF7A16EB00B94B01410CFD09BB240E6B0DE0087D4

Function 006B4189 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006B413A,00000000,?,006B40DA,00000000,006E7908,0000000C,006B4231,00000000,00000002), ref: 006B41A9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006B41BC
FreeLibrary.KERNEL32(00000000,?,?,?,006B413A,00000000,?,006B40DA,00000000,006E7908,0000000C,006B4231,00000000,00000002), ref: 006B41DF

Strings

CorExitProcess, xrefs: 006B41B4
mscoree.dll, xrefs: 006B41A2
8j, xrefs: 006B41CD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 8j$CorExitProcess$mscoree.dll
API String ID: 4061214504-4120268866
Opcode ID: 815620e0b14db9083a80008b7539669f2837738bed8674debe0b7dba5f147032
Instruction ID: 868c3adc1ecdfd4a7c52a9b5c2d58190e590c629e6a40ed01a960be4110588f9
Opcode Fuzzy Hash: 815620e0b14db9083a80008b7539669f2837738bed8674debe0b7dba5f147032
Instruction Fuzzy Hash: 5DF0AF70A4020CBBCB11AF94DC49BEEBFB6EF04755F044068F806A2650DF704E84CB91

Function 00698B85 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00698BF1

Strings

per-machine, xrefs: 00698C42, 00698C82
per-user, xrefs: 00698C4B, 00698C50, 00698C8B, 00698C90
Failed to calculate cache path., xrefs: 00698BAE
Failed to get old %hs package cache root directory., xrefs: 00698C91
Failed to get %hs package cache root directory., xrefs: 00698C51

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: 764574afed922054081ae37c531cffd3949e70a2cc38998c67b3100d2ca65a84
Instruction ID: 6bad9be94edd02c565a4c3ef042a47ac67ebb06a19416a0cb6b0720aefd293b7
Opcode Fuzzy Hash: 764574afed922054081ae37c531cffd3949e70a2cc38998c67b3100d2ca65a84
Instruction Fuzzy Hash: 6531F072A01225FFEF11AB648D42FBF666F9F02B60F110029FD01EB651DA649D4152B9

Function 0069E7A7 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 0069E7D6
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0069E7E5
SetWindowLongW.USER32(?,000000EB,?), ref: 0069E7F9
DefWindowProcW.USER32(?,?,?,?), ref: 0069E809
GetWindowLongW.USER32(?,000000EB), ref: 0069E823
PostQuitMessage.USER32(00000000), ref: 0069E882

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 0d7f1898a783683c296f0b672e95d1dc4ab86127944de4ba0da90769daa61bf7
Instruction ID: 5d65c7c006f0329d9cf152759b9422390f017c310f41d08565127dfc09eca8e5
Opcode Fuzzy Hash: 0d7f1898a783683c296f0b672e95d1dc4ab86127944de4ba0da90769daa61bf7
Instruction Fuzzy Hash: 8321B331104118BFDF059FA8DD59EAA3F6BFF49314F148628F91ADA2A0CA32DD10DB51

Function 006B5929 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,006B12E7,00000000,80004004,?,006B15EB,00000000,80004004,00000000,00000000), ref: 006B592D
_free.LIBCMT ref: 006B5960
_free.LIBCMT ref: 006B5988
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006B5995
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006B59A1
_abort.LIBCMT ref: 006B59A7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 824661479e6ee11553b7f7188bf813179f8544b8c9b04a31e71b2f213b66a3ef
Instruction ID: cb71ad9e138760fcd1bff6be2e11f7c355934e02713f9d464b5226f74c05e06e
Opcode Fuzzy Hash: 824661479e6ee11553b7f7188bf813179f8544b8c9b04a31e71b2f213b66a3ef
Instruction Fuzzy Hash: 75F0F9B1240F41EAC79233795C0AFEB251B9FC1734B25001CF516E6391EF2499C2436D

Function 006A5954 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000,?,?,?,006A6548,?,00000001,?,00000000), ref: 006A59BD

Strings

Failed to plan action for target product., xrefs: 006A5A68
Failed to insert execute action., xrefs: 006A5A12
Failed grow array of ordered patches., xrefs: 006A5A56
Failed to copy target product code., xrefs: 006A5AEE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.
API String ID: 1825529933-3432308488
Opcode ID: 6265b4c51c3fff67cfc709e6ff6c8a2acbee4d96d0de0afe7e8e5e5b5b59235f
Instruction ID: 4d3036bf7252a5b1410c867c95b96ea7a5b23c676aad9069b87f0f81ede12e14
Opcode Fuzzy Hash: 6265b4c51c3fff67cfc709e6ff6c8a2acbee4d96d0de0afe7e8e5e5b5b59235f
Instruction Fuzzy Hash: 0E8115B660074ADFCB14DF58C880AAA77A6FF09324F15866AED169B352D730ED11CF90

Function 0069C672 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 0069C6BA
CloseHandle.KERNEL32(?), ref: 0069C6C2

Strings

Failed to save state., xrefs: 0069C73A
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0069C861
Unexpected elevated message sent to child process, msg: %u, xrefs: 0069C86D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 4207627910-1654385460
Opcode ID: 1b2a92dc44df863ac3c4b304823e0672bd330cf702ec4e54ca172f87b05b6212
Instruction ID: 06c4791c50a45fbce5b0f2fac43fe7c0a375bb9936296d0b6a5eb0ab03129510
Opcode Fuzzy Hash: 1b2a92dc44df863ac3c4b304823e0672bd330cf702ec4e54ca172f87b05b6212
Instruction Fuzzy Hash: 2461937A100614EFCF125F94CE01C55BFABFF087207158559FAAA5BA32C732E921EB45

Function 006C72DE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

SysFreeString.OLEAUT32(00000000), ref: 006C743B
SysFreeString.OLEAUT32(00000000), ref: 006C7446
SysFreeString.OLEAUT32(00000000), ref: 006C7451

Strings

`)u, xrefs: 006C7430
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 006C7311

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-1656310558
Opcode ID: d76fc35020686db9c7c28a745dfd69587434f4f76d720966ccb20529f33cc2f2
Instruction ID: fa161519528fe48e69bb6c45abad8d9555a14feb99d0ca8dd8bbcccbb9eec034
Opcode Fuzzy Hash: d76fc35020686db9c7c28a745dfd69587434f4f76d720966ccb20529f33cc2f2
Instruction Fuzzy Hash: 62516F3190522AABCB15DF64C858FBEBBBAEF04714F15819CE905AB250D770EE04DFA0

Function 006A8FA9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,0069700A,000000B8,0000001C,00000100), ref: 006A8FD4
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00000000,000000FF,?,?,?,0069700A,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 006A905E

Strings

c:\agent\_work\66\s\src\burn\engine\detect.cpp, xrefs: 006A90BE
Failed to initialize update bundle., xrefs: 006A9101
BA aborted detect forward compatible bundle., xrefs: 006A90C8

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$c:\agent\_work\66\s\src\burn\engine\detect.cpp
API String ID: 1825529933-616552314
Opcode ID: 2f94912b35a70053b1df5d8a32f60743c4cb3f8e723564db57986a6e60f9d0e4
Instruction ID: 40aa34a951497f75d660f9e7de4fd7acb82d64ae7ade0b902fcb1a7d78365e37
Opcode Fuzzy Hash: 2f94912b35a70053b1df5d8a32f60743c4cb3f8e723564db57986a6e60f9d0e4
Instruction Fuzzy Hash: F0518E71600211BBDF15AF64CC81EAAB7ABFF06350F244658F9149A295C772ED60DFA0

Function 006C0AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,000000B8,00000000,00000000,000000B8,BundleUpgradeCode,000002C0,000000B8,00000000,00000000,?,00696FDF,00000100,000000B0), ref: 006C0ADC
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,?,?,00696FDF,00000100,000000B0,00000088,00000410,000002C0,00000100), ref: 006C0B13
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 006C0C05

Strings

BundleUpgradeCode, xrefs: 006C0ABB
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C0B56

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-1890108899
Opcode ID: 3c200810740a0e661717d15d8f62f9514eff8b121556fd528107b8b58e66f960
Instruction ID: 59857a87300de73adcca285231dbcade39b73a71f2875205f119135c37bd0923
Opcode Fuzzy Hash: 3c200810740a0e661717d15d8f62f9514eff8b121556fd528107b8b58e66f960
Instruction Fuzzy Hash: 6D419135A0021AEBEB21DF94C885FBEB7AAEF04714F15416EE901AB310D6319E01CBA4

Function 006C5B40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006C412E: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,006C5B5F,?,?,?,00000000,00000000,00000001), ref: 006C4146
Part of subcall function 006C412E: GetLastError.KERNEL32(?,006C5B5F,?,?,?,00000000,00000000,00000001,00000000,?,?,?,006C53FE,?,?,?), ref: 006C4150

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,006C53FE,?,?,?,?,?,?,?,00010000,?), ref: 006C5BA9
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,006C53FE,?,?,?,?), ref: 006C5BFB
GetLastError.KERNEL32(?,006C53FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 006C5C41
GetLastError.KERNEL32(?,006C53FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 006C5C67

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 006C5C8B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 133221148-16760509
Opcode ID: a2462cd3811f240a80c00fd71e0c836520268b4fbf09b99cfb4c63018252e5dd
Instruction ID: 6ea2fb0dda8207f0b625724a1ff2477e60f2d5282de6a5ffa8e4211db78636fa
Opcode Fuzzy Hash: a2462cd3811f240a80c00fd71e0c836520268b4fbf09b99cfb4c63018252e5dd
Instruction Fuzzy Hash: 73418E7250071AAFDB218E94CD44FFA7B6AEF04354F15012DFD02AA190D774ED90DBA4

Function 0068252E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,006BF8C7,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006BF8C7,006A1074,?,00000000), ref: 00682574
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006BF8C7,006A1074,?,00000000,0000FDE9,?,006A1074), ref: 00682580

Part of subcall function 00683C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006822D5,000001C7,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683C67
Part of subcall function 00683C5F: HeapSize.KERNEL32(00000000,?,006822D5,000001C7,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 006825A4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: fcbe653b9a722a15c52a32cb871e2d2656f12858dd19c04b13ab7da8f8b2e102
Instruction ID: 1cc4afeefa35d225596308506b2968e734e6c9c6feb44fc713e2cf9feceace69
Opcode Fuzzy Hash: fcbe653b9a722a15c52a32cb871e2d2656f12858dd19c04b13ab7da8f8b2e102
Instruction Fuzzy Hash: B331A77124021BAFE710BF648CF0EB6379BAB54768B104329FE119B390EA71CC519765

Function 006B8AD8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,BCE85006,006B1C3F,00000000,00000000,006B2C74,?,t,k,?,00000001,006B1C3F,BCE85006,00000001,006B2C74,006B2C74), ref: 006B8B25
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006B8BAE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 006B8BC0
__freea.LIBCMT ref: 006B8BC9

Part of subcall function 006B5D22: RtlAllocateHeap.NTDLL(00000000,?,?,?,006B1782,?,0000015D,?,?,?,?,006B2BDB,000000FF,00000000,?,?), ref: 006B5D54

Strings

t,k, xrefs: 006B8AEB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID: t,k
API String ID: 2652629310-1340656352
Opcode ID: d326098ac5e4cb1e0a63bb986486b1b687f33452c27c3ea2953b338296371b40
Instruction ID: b5498ecf72da5f39f8cd7f4e5fb9f464600210e702246e0426aff6f582cb66a0
Opcode Fuzzy Hash: d326098ac5e4cb1e0a63bb986486b1b687f33452c27c3ea2953b338296371b40
Instruction Fuzzy Hash: 45318FB2A0020AAFDF259F75DC45DEE7BAAEB40310B154168F805D7251EB35DD91CB90

Function 006C3A14 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,?,?,006C3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00699F39,00000001), ref: 006C3A32
GetLastError.KERNEL32(00000002,?,006C3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00699F39,00000001,000007D0,00000001,00000001,00000003), ref: 006C3A41
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,006C3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00699F39,00000001), ref: 006C3ADA
GetLastError.KERNEL32(?,006C3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00699F39,00000001,000007D0,00000001,00000001,00000003,000007D0), ref: 006C3AE4

Part of subcall function 006C3C72: FindFirstFileW.KERNEL32(006A8F6B,?,00000001,00000000,00000000), ref: 006C3CAD
Part of subcall function 006C3C72: FindClose.KERNEL32(00000000), ref: 006C3CB9

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C3B03

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3479031965-1688708105
Opcode ID: 292019193c206db9046d3779f1da81563eca87247209c25d91b5b98a529980dc
Instruction ID: 866e46637dc38d41519901a939afdd916ae027a6281655b1205cec46f52a07ad
Opcode Fuzzy Hash: 292019193c206db9046d3779f1da81563eca87247209c25d91b5b98a529980dc
Instruction Fuzzy Hash: 6F310232A00236ABDB215E988D05FBA7657EF60BA0F16C12EFC44AB350D771CE5283D4

Function 006AAA41 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 006AAAB0

Strings

Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 006AAB45
Failed to extract all payloads from container: %ls, xrefs: 006AAAF4
Failed to extract payload: %ls from container: %ls, xrefs: 006AAB39
Failed to open container: %ls., xrefs: 006AAA82

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: 03dac60f011effd31aa8a182eff0fb07b86949787592a31f90b1bdc0660cc038
Instruction ID: a3248fabb6e2729dc19deb2840bbd838b0896a74c079ee7ac9d87359cd192f8d
Opcode Fuzzy Hash: 03dac60f011effd31aa8a182eff0fb07b86949787592a31f90b1bdc0660cc038
Instruction Fuzzy Hash: 2531E332C00115BBCF11BEE4CD42E9E77ABAF05720F110226FA11A7291E3719E55DFA6

Function 0068EFB7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,?,PackageVersion,?,00000000,006905EB,00000001,?,?,006905EB,00000000), ref: 0068F02F
RegCloseKey.ADVAPI32(00000000,?,PackageVersion,?,00000000,006905EB,00000001,?,?,006905EB,00000000,?,00000000,?,006905EB,?), ref: 0068F04C

Strings

PackageVersion, xrefs: 0068F010
Failed to remove update registration key: %ls, xrefs: 0068F077
Failed to format key for update registration., xrefs: 0068EFE5

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 8acf07688a3c7951e431be499cf8c26bcb39d98513d5533262852fa974aa4a08
Instruction ID: 8f5d220ae27853f94a0f00e0dc4df8bd715e1e997a3defe59e605e4e67ab7a75
Opcode Fuzzy Hash: 8acf07688a3c7951e431be499cf8c26bcb39d98513d5533262852fa974aa4a08
Instruction Fuzzy Hash: E121B131D40229BEDB21BBA5CD09FAEBABADF05764F104279F900A6291E7708A40C794

Function 006C3843 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000,?,00000000,00000000,?,006C395E,00000000,?,00000000,00000000,?,006984D1,?,?), ref: 006C385D
GetLastError.KERNEL32(?,006C395E,00000000,?,00000000,00000000,?,006984D1,?,?,00000001,00000003,000007D0,?,?,00000000), ref: 006C386B
CopyFileW.KERNEL32(00000000,?,00000000,?,00000000,?,006C395E,00000000,?,00000000,00000000,?,006984D1,?,?,00000001), ref: 006C38DD
GetLastError.KERNEL32(?,006C395E,00000000,?,00000000,00000000,?,006984D1,?,?,00000001,00000003,000007D0,?,?,00000000), ref: 006C38E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C3906

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 374144340-1688708105
Opcode ID: 49c84c8b539ff4380c5f4617d175e9044f148e79509394404e18690e0d3f9219
Instruction ID: e17d194768e8134595910f95560aefc8d702a287cf6085605f2fec33664f004a
Opcode Fuzzy Hash: 49c84c8b539ff4380c5f4617d175e9044f148e79509394404e18690e0d3f9219
Instruction Fuzzy Hash: 52213B37B01632979B201A958D08FB7A69BEF50750B05C12DFD04DB350FAB1CE0142D1

Function 0068EECF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0068EF0A

Part of subcall function 006C3984: SetFileAttributesW.KERNEL32(006A8F6B,00000080,00000000,006A8F6B,000000FF,00000000,?,?,006A8F6B), ref: 006C39B3
Part of subcall function 006C3984: GetLastError.KERNEL32(?,?,006A8F6B), ref: 006C39BD

Part of subcall function 00683CF7: RemoveDirectoryW.KERNEL32(?), ref: 00683D14

Strings

Failed to allocate regid file path., xrefs: 0068EF69
Failed to format tag folder path., xrefs: 0068EF77
Failed to allocate regid folder path., xrefs: 0068EF70
swidtag, xrefs: 0068EF19

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: 8f8512149973bbbdac8e765d225294b08d96de290757af7627b5f44592d39791
Instruction ID: a7a197a18b6bd34ef69811a5d6e16d6dc3f67e5cfd394960637a0056182b43b0
Opcode Fuzzy Hash: 8f8512149973bbbdac8e765d225294b08d96de290757af7627b5f44592d39791
Instruction Fuzzy Hash: 5B218F31D00218BBCB01FB99CC41A9DFBB6EF44710F10C26AE604AA261D7729E40DB54

Function 006A8AF2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000001,00000100,000000B5), ref: 006A8B76
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000001,00000100,000000B5,?,?,?,0068F782,00000001,00000001,000000B5,00000000), ref: 006A8BC4

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 006A8B13
Failed to enumerate uninstall key for related bundles., xrefs: 006A8BD3
Failed to open uninstall registry key., xrefs: 006A8B39

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 5eca78b61d010b57af0643ed18271de1d4cf11686c0a9254c5b22fe295a82b57
Instruction ID: 9d384e9772431c22578390a44687495efdd34cb15038226aae88b06746ae6d5f
Opcode Fuzzy Hash: 5eca78b61d010b57af0643ed18271de1d4cf11686c0a9254c5b22fe295a82b57
Instruction Fuzzy Hash: EF21A372910218FFDF157B94CC85FEEBA7BEB01324F244269F410771A0DA755E90DAA4

Function 006ACF33 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

WaitForSingleObject.KERNEL32(?,000000FF), ref: 006ACFC8
ReleaseMutex.KERNEL32(?), ref: 006ACFF6
SetEvent.KERNEL32(?), ref: 006ACFFF

Strings

Failed to allocate buffer., xrefs: 006ACF77
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 006ACF6D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 944053411-3017045536
Opcode ID: dede35a051254cc62979de620bbd9ff6af0bb2a77cc911894eac0cfd963ef68c
Instruction ID: e762dd574dc38f210d1ea0a7c92af5888be5fdc2171f397509d0fa6c124b18b6
Opcode Fuzzy Hash: dede35a051254cc62979de620bbd9ff6af0bb2a77cc911894eac0cfd963ef68c
Instruction Fuzzy Hash: 3721D1B0A0021ABFDB00AF68D845A99B7F6FF49324F148629F965A7351C375AD50CF90

Function 00684263 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0068429E
GetLastError.KERNEL32 ref: 006842AA
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000), ref: 006842E5
GetLastError.KERNEL32 ref: 006842EF

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00684313

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 152501406-2061300336
Opcode ID: 3c320e7b75f70b7c47d1f8f69ac7da0ed2236812d7fbf6d0fd53a915a42142ff
Instruction ID: cae100f5f1805f2abc039ba0b6e6fc0d5ac10ffe36cb9392782fca5cd1aa4976
Opcode Fuzzy Hash: 3c320e7b75f70b7c47d1f8f69ac7da0ed2236812d7fbf6d0fd53a915a42142ff
Instruction Fuzzy Hash: C7118777A01637A79721A6D54C54FAFBA5A9F01798B110329FD00FB300EA25DD0087E4

Function 006C2823 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 006C288A
SysFreeString.OLEAUT32(?), ref: 006C28A5
SysFreeString.OLEAUT32(?), ref: 006C28B4

Strings

"0l, xrefs: 006C282D, 006C284C, 006C285A, 006C2868, 006C2831, 006C284F, 006C285D, 006C286B
"0l, xrefs: 006C282A, 006C2836, 006C2850, 006C285E, 006C286C, 006C287A, 006C2895

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeString
String ID: "0l$"0l
API String ID: 3341692771-304995149
Opcode ID: 56abe470e08cfadc8bf14701dc94aa1494f67f4d3b28695e280be4b4609ed2e4
Instruction ID: e717df525cdf2847b51b511a3dfd09c611534649368a84261f36200656d7893e
Opcode Fuzzy Hash: 56abe470e08cfadc8bf14701dc94aa1494f67f4d3b28695e280be4b4609ed2e4
Instruction Fuzzy Hash: F8213B71A1211AEFDB15CF95C994EEEBBB9FF84744B20019EE90193150EB70EA05DB24

Function 006C2AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 006C2AC4
VariantInit.OLEAUT32(?), ref: 006C2AD0
VariantClear.OLEAUT32(?), ref: 006C2B44
SysFreeString.OLEAUT32(00000000), ref: 006C2B4F

Part of subcall function 006C2CFC: SysAllocString.OLEAUT32(?), ref: 006C2D11

Strings

`)u, xrefs: 006C2B4F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `)u
API String ID: 347726874-4279031584
Opcode ID: 5ded0f728baf76b2c2f5e86f51e136ae9493e258274e7f76be23c1fe57d0043b
Instruction ID: 14d2f74adfb337599e13cd95616a9240459cb7ed7149b8340a795bec3a1719a2
Opcode Fuzzy Hash: 5ded0f728baf76b2c2f5e86f51e136ae9493e258274e7f76be23c1fe57d0043b
Instruction Fuzzy Hash: 5421F871A0121AABCB15DFA4C868FBEBBBAFF44719F15019CE905DB221D7309E05CB90

Function 006897FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 0068988D

Strings

Failed to find variable., xrefs: 0068987A
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 0068982F, 00689870
Failed to parse condition '%ls' at position: %u, xrefs: 0068983F
Failed to read next symbol., xrefs: 006898A9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 2001391462-1451669575
Opcode ID: c15299a7a261ab5a3071165047633c9371718487667975e322523a7f30ca45fa
Instruction ID: 58bac765df3592c9dac9e6d42dc55be0ea8644ec3de7f3f23161c3caae75e53e
Opcode Fuzzy Hash: c15299a7a261ab5a3071165047633c9371718487667975e322523a7f30ca45fa
Instruction Fuzzy Hash: 5E112E736902117ADB693E688C46EF73A17EB07720F040614FD046D392CA62D91087F5

Function 006949FF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00000001,00000000,00000000,00000000,?,00695322), ref: 00694A4B

Strings

Failed to write message type to pipe., xrefs: 00694A8D
Failed to allocate message to write., xrefs: 00694A2A
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00694A83

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 3934441357-221464841
Opcode ID: bd9dab601430c3dd92b068d5078fed949d8b8784476b4c2cf0b0b48ce3708b86
Instruction ID: 2aa2008593e87ee7c71df3767edae67e4ca86afb094e19b66c98062e56ed9df6
Opcode Fuzzy Hash: bd9dab601430c3dd92b068d5078fed949d8b8784476b4c2cf0b0b48ce3708b86
Instruction Fuzzy Hash: 22119D72A80229BBCF21DF94CD05EDE7AAEEF40750F110166F800B6354EA319E01D7A9

Function 00689DDA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00689DFC

Strings

Failed to format path string., xrefs: 00689E07
Failed to set variable., xrefs: 00689E5B
File search: %ls, did not find path: %ls, xrefs: 00689E67
Failed get file version., xrefs: 00689E3C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: c421fe5f49d70aabeaf7a509886c635ac4f6cd2fda2bd01df3ed397453009f7b
Instruction ID: 856a167006cf9cdfcda2f35e2416405d43b27d0e10c76a3cc0440f6480c77962
Opcode Fuzzy Hash: c421fe5f49d70aabeaf7a509886c635ac4f6cd2fda2bd01df3ed397453009f7b
Instruction Fuzzy Hash: B811D076D00128BECF02BA94DC46DFEBF7AEF00350B15426AF900A6221D6719E10EBE0

Function 006980F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00698CEE,0000001A,?,?,00000000,00000000), ref: 0069813F
GetLastError.KERNEL32(?,?,00698CEE,0000001A,?,?,00000000,00000000,?,?,?), ref: 00698149

Strings

Failed to allocate memory for well known SID., xrefs: 00698127
Failed to create well known SID., xrefs: 00698177
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 0069811D, 0069816D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2186923214-2807399336
Opcode ID: 4e384202b373dec0eaebe723f77592d5c2ce601c11497e2a2f3f7bc0650693e4
Instruction ID: 1ba5ea908d18ca85140f41dc566a7469daa3c9c08e51b04417f51020c662daa3
Opcode Fuzzy Hash: 4e384202b373dec0eaebe723f77592d5c2ce601c11497e2a2f3f7bc0650693e4
Instruction Fuzzy Hash: 3E014C376012367FD72066509C06E9B6A5F8F42F60F11001AFD01BF740EE648D4182E4

Function 006945CE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

_memcpy_s.LIBCMT ref: 0069461F
_memcpy_s.LIBCMT ref: 00694632
_memcpy_s.LIBCMT ref: 0069464D

Strings

Failed to allocate memory for message., xrefs: 00694608
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 006945FE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 886498622-324645513
Opcode ID: 9ac3d53ef2fa213b77509b3561e283051dadce50301a081f37e96fb3ffd599fb
Instruction ID: d4fd867261bd9f5e65c894ab1ad0d040c6c61909212c84a6dc76131f4abb328b
Opcode Fuzzy Hash: 9ac3d53ef2fa213b77509b3561e283051dadce50301a081f37e96fb3ffd599fb
Instruction Fuzzy Hash: 871194B2500319BBDB01EF94CC82DDB73AEAF05B00B00452AFA10DB251EB71D610C7E5

Function 006ADA54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 006ADA82
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006ADAAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,006ADC7A,00000000,?,?,?,00000000,00000000), ref: 006ADAB4

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 006ADAD8
Failed while waiting for download., xrefs: 006ADAE2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 435350009-842194682
Opcode ID: e21b8be0c52cc901e1b2517979510bb6de327236710f5ad10feb3ae607f9257a
Instruction ID: 803fb3ffed5839e7c7efd39a9030c94d5fc4bca5006865a354a71504c2c6beaf
Opcode Fuzzy Hash: e21b8be0c52cc901e1b2517979510bb6de327236710f5ad10feb3ae607f9257a
Instruction Fuzzy Hash: 42012973A4523577D7206BA8DC09EEB7B9ADB06710F000125FF06F62C1D6A49D0085E4

Function 00685F5A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 00685F88
GetLastError.KERNEL32 ref: 00685F92

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00685FB6
Failed to get computer name., xrefs: 00685FC0
Failed to set variant value., xrefs: 00685FD9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 3560734967-833936685
Opcode ID: 2ee50a43eb0496ec58ae2c2e4ab71f6e1cb83d9f32899fd275161066e52bdcfb
Instruction ID: 7c9fad94f87affcb1611cba8ba4786e6b60800261dd9c7ab225b02ea941ea235
Opcode Fuzzy Hash: 2ee50a43eb0496ec58ae2c2e4ab71f6e1cb83d9f32899fd275161066e52bdcfb
Instruction Fuzzy Hash: 4401A933A0162867D711BAA59D01EDE77EAAF09714F510129FE01FB280EA64EE048BE5

Function 006867C2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 006867FB
GetLastError.KERNEL32 ref: 00686805

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00686829
Failed to get temp path., xrefs: 00686833
Failed to set variant value., xrefs: 0068684F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1238063741-3623708253
Opcode ID: cbab211af3884c67f94d025acdd0ee475c3251dd6ee900a6e1ebf75c9174e854
Instruction ID: 9df2d58c22b0bcff26b9c44aea7e0dbb5db0a7701bf84bb97a3c5d7e6d54e894
Opcode Fuzzy Hash: cbab211af3884c67f94d025acdd0ee475c3251dd6ee900a6e1ebf75c9174e854
Instruction Fuzzy Hash: 0C014EB2E4133967D710B7A09C0AFEE739A9F01714F11026CFD05FB281EA64AD0447E9

Function 00685EC2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00685ED4

Part of subcall function 006C038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00685EE0,00000000), ref: 006C039E
Part of subcall function 006C038A: GetProcAddress.KERNEL32(00000000), ref: 006C03A5
Part of subcall function 006C038A: GetLastError.KERNEL32(?,?,?,00685EE0,00000000), ref: 006C03BC

Part of subcall function 006C3578: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 006C35A5

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00685EFE
Failed to get 64-bit folder., xrefs: 00685F1E
Failed to get shell folder., xrefs: 00685F08
Failed to set variant value., xrefs: 00685F38

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2084161155-2957518125
Opcode ID: 22f95d2e9c51679fbff16da639f5c8f031394fdfd0a8c5fd386716883acc4d82
Instruction ID: b602e9cc57dc61d575345d7c05a5d4d169d4361ab49f7d1e56d86fa967a3c7db
Opcode Fuzzy Hash: 22f95d2e9c51679fbff16da639f5c8f031394fdfd0a8c5fd386716883acc4d82
Instruction Fuzzy Hash: 8D01C431914629FBDF12B7A0CC0AFEE7B6BDF00761F118259F901BA150DB749A40DB95

Function 006C02EC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000001F4,?,00000000,?,006A2302,?,000001F4,?,?,?,?,?,?,?,?), ref: 006C02F8
GetLastError.KERNEL32(?,006A2302,?,000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0306
GetExitCodeProcess.KERNEL32(000001F4,?), ref: 006C034B
GetLastError.KERNEL32(?,006A2302,?,000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006C0355

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 006C032A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 590199018-2457365779
Opcode ID: 7968b91aaccd41cc42c792b32dcda1f675499c80d99460dea252c75ecec09266
Instruction ID: 5fa72540d40e8c2bf9c4398e037745ace9f6b836c3f5388488bd45cb3a693288
Opcode Fuzzy Hash: 7968b91aaccd41cc42c792b32dcda1f675499c80d99460dea252c75ecec09266
Instruction Fuzzy Hash: 8801A536944177E7EB204A949D08FBE7A96EF047B0F124219FD58EF340D2358C008AD5

Function 006C3984 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006C3C72: FindFirstFileW.KERNEL32(006A8F6B,?,00000001,00000000,00000000), ref: 006C3CAD
Part of subcall function 006C3C72: FindClose.KERNEL32(00000000), ref: 006C3CB9

SetFileAttributesW.KERNEL32(006A8F6B,00000080,00000000,006A8F6B,000000FF,00000000,?,?,006A8F6B), ref: 006C39B3
GetLastError.KERNEL32(?,?,006A8F6B), ref: 006C39BD
DeleteFileW.KERNEL32(006A8F6B,00000000,006A8F6B,000000FF,00000000,?,?,006A8F6B), ref: 006C39DD
GetLastError.KERNEL32(?,?,006A8F6B), ref: 006C39E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C3A02

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3967264933-1688708105
Opcode ID: 25eec60b270c0fc6be97cadee1f2dd2d82a9865b65ea446c8146a8107e030d17
Instruction ID: abbcfa1dc8de8ef6e095b4f51af97f0215c297f63f0672f6be2a30cddf1b100a
Opcode Fuzzy Hash: 25eec60b270c0fc6be97cadee1f2dd2d82a9865b65ea446c8146a8107e030d17
Instruction Fuzzy Hash: F301D632A01679A7C72157A9CD05FBB7D96EF10B95F018218FC46FA390E660CE1085D4

Function 006AD6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006AD6D8
LeaveCriticalSection.KERNEL32(?), ref: 006AD71D
SetEvent.KERNEL32(?,?,?,?), ref: 006AD731

Strings

Failed to get state during job modification., xrefs: 006AD6F1
Failure while sending progress during BITS job modification., xrefs: 006AD70C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 202910e50d175e2dc6f17bdb13aa71f9f0e867ba0679fa2229273ab7db3b39bd
Instruction ID: 5ac9441c535b09972e7bbe0e818f56a11a86d23b822d6ac230d2e69c9472cf6f
Opcode Fuzzy Hash: 202910e50d175e2dc6f17bdb13aa71f9f0e867ba0679fa2229273ab7db3b39bd
Instruction Fuzzy Hash: E8019272A01625BBCB05AB55C849DAEB7BABF05328B100115F406D7A51D774ED04CAE5

Function 006AD4AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,006ADC04,?,?,?,?,?,00000000,00000000,?), ref: 006AD4C4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,006ADC04,?,?,?,?,?,00000000,00000000,?), ref: 006AD4CF
GetLastError.KERNEL32(?,006ADC04,?,?,?,?,?,00000000,00000000,?), ref: 006AD4DC

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 006AD500
Failed to create BITS job complete event., xrefs: 006AD50A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 3069647169-683598956
Opcode ID: a0d08e3b9dd0e9a6824f374176507559da95540801e4ecd6ef9723c55ec22198
Instruction ID: 5a78f56559759be49b0df6b2453942b4fbf298583da4dd3af1098fe7d2676647
Opcode Fuzzy Hash: a0d08e3b9dd0e9a6824f374176507559da95540801e4ecd6ef9723c55ec22198
Instruction Fuzzy Hash: 8001B5B69016366BC310AF59DC05A86BFAAFF0AB64B014126FD09D7B40D7B4E800CBE4

Function 006AD936 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,006ADAA2), ref: 006AD94A
LeaveCriticalSection.KERNEL32(00000008,?,006ADAA2), ref: 006AD98F
SetEvent.KERNEL32(?,?,006ADAA2), ref: 006AD9A3

Strings

Failure while sending progress., xrefs: 006AD97E
Failed to get BITS job state., xrefs: 006AD963

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 0e74956f49bb810317fa452ca55686118f5cde2a6b188b056ffe93869388e21b
Instruction ID: 43eaefbdfea9b1bcb8945ff9288c4dd42f712b1f954336f7dce130ffcbbe3f56
Opcode Fuzzy Hash: 0e74956f49bb810317fa452ca55686118f5cde2a6b188b056ffe93869388e21b
Instruction Fuzzy Hash: 4001B172A01625BFC702AB55D849DAEB7AEFF06728B040126E40693A50DB74ED04CBD5

Function 006C3209 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006C324E
SysFreeString.OLEAUT32(00000000), ref: 006C3281

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C321F, 006C3265
BTh, xrefs: 006C3209
`)u, xrefs: 006C3281

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: BTh$`)u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-2425368111
Opcode ID: dfbec0afd30a01cd4d31a6fd7aae7dec17ab1387c8bccd8c98c88e6196b2d51b
Instruction ID: 4b78c330be2dce587508b7dce7089d0841fc59ff006a0eb0c7bd84908d09dfda
Opcode Fuzzy Hash: dfbec0afd30a01cd4d31a6fd7aae7dec17ab1387c8bccd8c98c88e6196b2d51b
Instruction Fuzzy Hash: 2301A232641266BBDB201AA59C09FBA769ADF51BA4F11812DFD04EB340C678CF014691

Function 006A6951 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(ehj,00000001,?,00000001,00000000,?,?,?,?,?,?,006A6865,00000000), ref: 006A6979
GetLastError.KERNEL32(?,?,?,?,?,?,006A6865,00000000), ref: 006A6983

Strings

ehj, xrefs: 006A6961, 006A6978
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 006A69A7
Failed to stop wusa service., xrefs: 006A69B1

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$ehj
API String ID: 4114567744-2124446354
Opcode ID: 98e77ee8549f01bbee9b3e955c7b482b2f6f5201109b9d06f94df6c99e2366ae
Instruction ID: a2b96dd6c5cccda5cf4187ea7dd6f5f15c1e90e4a357ca6f40645e330e1a831b
Opcode Fuzzy Hash: 98e77ee8549f01bbee9b3e955c7b482b2f6f5201109b9d06f94df6c99e2366ae
Instruction Fuzzy Hash: 8E01F773B402396BD710A7B49C05EEB77E6EF49B64F010129FD00BB280E9749C0086E5

Function 0068D461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00696F37,000000B8,00000000), ref: 0068D470
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0068D47F
LeaveCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00696F37,000000B8,00000000), ref: 0068D494

Strings

Engine active cannot be changed because it was already in that state., xrefs: 0068D4B7
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 0068D4AD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 3376869089-1173769119
Opcode ID: c0ac5d9d3ea62afdcf49fec64cf8b79351e3e8c02fd4efbd89a75667f542c279
Instruction ID: d77aa42cd4978830df194be71b02af48cab4015a334b5cc17fd2349722937ebf
Opcode Fuzzy Hash: c0ac5d9d3ea62afdcf49fec64cf8b79351e3e8c02fd4efbd89a75667f542c279
Instruction Fuzzy Hash: D3F087762002086F9710AFEAAC88DA773AEEA95769704053AF905C7690EA78F9048770

Function 006C1511 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 006C153C
GetLastError.KERNEL32(?,00684A21,00000001,?,?,Function_0000459E,?), ref: 006C154B

Strings

srclient.dll, xrefs: 006C151A
SRSetRestorePointW, xrefs: 006C1531
c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 006C156C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\66\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-2605395416
Opcode ID: 856e7a32a7cc5d2b4fe50ef4be2668a23bca3ab53a6515abeee71485f2de81e2
Instruction ID: 0a07f6d80b97196bb6e49026e562d987439b4504912ef179f2a2f60bc4fbb2d5
Opcode Fuzzy Hash: 856e7a32a7cc5d2b4fe50ef4be2668a23bca3ab53a6515abeee71485f2de81e2
Instruction Fuzzy Hash: F501A7F2A9177693D32122955C09F7A2947DB83B64F82012EFD02AE352D660CC4086D9

Function 006B4682 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006B46F4
_free.LIBCMT ref: 006B4714

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2587d8eb42d84af48e05349cde377f8a225ba7a60112929b44c1912e09b1eddc
Instruction ID: 4bca04e779da82a284de86d803d5dc6949be65daa3df5ae512f9253168a9b7f1
Opcode Fuzzy Hash: 2587d8eb42d84af48e05349cde377f8a225ba7a60112929b44c1912e09b1eddc
Instruction Fuzzy Hash: 6C41D476A002109FCB20DFB8C881AADB7B7EF8A314B15456DE515EB352EF31AD41CB80

Function 006822B5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006822FB
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00682307

Part of subcall function 00683C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006822D5,000001C7,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683C67
Part of subcall function 00683C5F: HeapSize.KERNEL32(00000000,?,006822D5,000001C7,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 0068232B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: b9339b65cced443a81cb83896020b5403ae3b72e6f2a3320754e8af3544043d7
Instruction ID: c087d88b5bcc7fe019ed397767130806e850b24c88ed961a9c891528553361bf
Opcode Fuzzy Hash: b9339b65cced443a81cb83896020b5403ae3b72e6f2a3320754e8af3544043d7
Instruction Fuzzy Hash: 6F31FA3260012BEBDB21BE65CC74EAA7B97AF05764B114328FD159B390EA79CC41D7D0

Function 006C8C74 Relevance: 7.6, APIs: 5, Instructions: 118registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

RegCloseKey.ADVAPI32(?,?,?,00000000,?,?,00000000,00000001,?,00020019,?,00000000,00000000,00020019,?,?), ref: 006C8D4C
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000,00000000,?,?,00000000,?,?,00000000,00000001,?,00020019), ref: 006C8D87
RegCloseKey.ADVAPI32(?,?,00020019,00000000,00000000,00000000,00000000,?,?), ref: 006C8DA3
RegCloseKey.ADVAPI32(?,?,00020019,00000000,00000000,00000000,00000000,?,?), ref: 006C8DB0
RegCloseKey.ADVAPI32(00000000,?,00020019,00000000,00000000,00000000,00000000,?,?), ref: 006C8DBD

Part of subcall function 006C0886: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,006C8D39,?), ref: 006C089E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: f56cfca9f237532ae0aaa5b705b8898e9499b66fcc437b89bf619d649f5b4511
Instruction ID: 629b55923db4299818cdee9615330dc16b8975ff2b55e5e1c0e6bc421e506907
Opcode Fuzzy Hash: f56cfca9f237532ae0aaa5b705b8898e9499b66fcc437b89bf619d649f5b4511
Instruction Fuzzy Hash: 2F413672C0122DFFDF21AF948D91EEDBA7AEF14754B12416EEA0167260DA319E409B90

Function 006889E8 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00688BA7,006896F4,?,006896F4,?,?,006896F4,?,?), ref: 00688A08
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00688BA7,006896F4,?,006896F4,?,?,006896F4,?,?), ref: 00688A10
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00688BA7,006896F4,?,006896F4,?), ref: 00688A5F
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00688BA7,006896F4,?,006896F4,?), ref: 00688AC1
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00688BA7,006896F4,?,006896F4,?), ref: 00688AEE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 49444c90122ef9fac884ba9a102c133f52bf1a722674b7c2063be90848e16cda
Instruction ID: 5f5b03958394476bad3402046d286b06209e9d213cdf04317fd3416a1196df54
Opcode Fuzzy Hash: 49444c90122ef9fac884ba9a102c133f52bf1a722674b7c2063be90848e16cda
Instruction Fuzzy Hash: 0131A472A01108BFCF199F98CC849EE3F6BEF48390F548616F9099B250CA318D91DBA0

Function 006B59AD Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000100,00000000,006B372D,00683CE2,80004005,00000000,?,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7), ref: 006B59B2
_free.LIBCMT ref: 006B59E7
_free.LIBCMT ref: 006B5A0E
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 006B5A1B
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 006B5A24

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 155f5e59dc5c575c825ab6c2f5c29a1cd23054b54328890a3833afe68404330f
Instruction ID: 8c5c0be6d374db9fe88763da3940b92253e868acd681ec55dd9b1bb945269df4
Opcode Fuzzy Hash: 155f5e59dc5c575c825ab6c2f5c29a1cd23054b54328890a3833afe68404330f
Instruction Fuzzy Hash: D301F2B2260F40AB875277655C86FEB251BEBC1374325012DF417A2292EE218DC24369

Function 006ACE2C Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,006ACE24,00000000), ref: 006ACE47
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,006ACE24,00000000), ref: 006ACE53
CloseHandle.KERNEL32(?,00000000,?,00000000,?,006ACE24,00000000), ref: 006ACE60
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,006ACE24,00000000), ref: 006ACE6D
UnmapViewOfFile.KERNEL32(?,00000000,?,006ACE24,00000000), ref: 006ACE7C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: cbc357be71655d4d04796952d598b12c4056f7be80ba5da877bf1f518ead1e2d
Instruction ID: b56b8754d00efa22e681d8560bfdebcd55f949d11fc89732f891ebd3bdc68712
Opcode Fuzzy Hash: cbc357be71655d4d04796952d598b12c4056f7be80ba5da877bf1f518ead1e2d
Instruction Fuzzy Hash: 6501F632501B55DFCB316FA6D880857FBEABF61725315C93EE29652A20C371AC40DF80

Function 006B890A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006B8922

Part of subcall function 006B5CE8: HeapFree.KERNEL32(00000000,00000000,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?), ref: 006B5CFE
Part of subcall function 006B5CE8: GetLastError.KERNEL32(?,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?,?), ref: 006B5D10

_free.LIBCMT ref: 006B8934
_free.LIBCMT ref: 006B8946
_free.LIBCMT ref: 006B8958
_free.LIBCMT ref: 006B896A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ead35fb89177bfc33b81c8a34a4a0a01888ce5d12e4eeb8b85dd6ed7c1749a3f
Instruction ID: 5b7897ccbc9ef5781cd8b4ede92e90a2983532f603b36561e8cdc9b2b1a7835b
Opcode Fuzzy Hash: ead35fb89177bfc33b81c8a34a4a0a01888ce5d12e4eeb8b85dd6ed7c1749a3f
Instruction Fuzzy Hash: FFF0FFB6554744AB8AA0EB98E5C6DEA77EFFA00710794180DF049DB611CB31FCC18759

Function 006B48D1 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006B48EF

Part of subcall function 006B5CE8: HeapFree.KERNEL32(00000000,00000000,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?), ref: 006B5CFE
Part of subcall function 006B5CE8: GetLastError.KERNEL32(?,?,006B89A1,?,00000000,?,00000000,?,006B89C8,?,00000007,?,?,006B8E2A,?,?), ref: 006B5D10

_free.LIBCMT ref: 006B4901
_free.LIBCMT ref: 006B4914
_free.LIBCMT ref: 006B4925
_free.LIBCMT ref: 006B4936

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3f18d9df365c17661c59040f91c55a23f4e17ec1733114ff04f4df13a23f14fa
Instruction ID: 41811232be7150b2bc0b4b758fd9a708bf738f761bbebca93f2303f60cab671a
Opcode Fuzzy Hash: 3f18d9df365c17661c59040f91c55a23f4e17ec1733114ff04f4df13a23f14fa
Instruction Fuzzy Hash: 73F03AB48127A28B87916F58BC835C63B63F725720315355EF0215A271CB3129928F89

Function 006C095E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,00000000,00000088,000000B8,00000088,00000002,000000B8,BundleUpgradeCode,000002C0,00000088,000000B8,00000000), ref: 006C09D4
RegQueryValueExW.ADVAPI32(?,00000088,00000000,?,00000088,00000088,00000088,?), ref: 006C0A0C

Strings

BundleUpgradeCode, xrefs: 006C0967
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C0A48

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: QueryValue
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3660427363-1890108899
Opcode ID: b5d9068abbbb79b6d46ad9bdede774d6027e29d2e5f4788479dfa716332a4838
Instruction ID: e2ba8b6be0eef0b2d9d687ecbe202962e6cfd9194a3a5a045dfe31aa16100b9e
Opcode Fuzzy Hash: b5d9068abbbb79b6d46ad9bdede774d6027e29d2e5f4788479dfa716332a4838
Instruction Fuzzy Hash: 0B416271D0022AFBEB21DED4C885EBEBBBAEF00750F10416EE914AB252D7319E51CB50

Function 006C2F2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 006C2F46
SysAllocString.OLEAUT32(?), ref: 006C2F56
VariantClear.OLEAUT32(?), ref: 006C3035

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C2F6E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 2213243845-3017383397
Opcode ID: 929d750d20e82f5213dcf3fdaec3702b9258b77501b52c5c6b6e356a31d6789a
Instruction ID: ae1a962becacd8b5d05d89bca10e582fa627d2f16f71fa77836548b3af1bc0f5
Opcode Fuzzy Hash: 929d750d20e82f5213dcf3fdaec3702b9258b77501b52c5c6b6e356a31d6789a
Instruction Fuzzy Hash: 7E418376A00265ABCB10AFA4C888FBEBBB9EF05750B0541ADFD15EB301D735DD408BA0

Function 006B08B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006B08E3
__IsNonwritableInCurrentImage.LIBCMT ref: 006B099C

Strings

csm, xrefs: 006B0986
8j, xrefs: 006B09B5

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: 8j$csm
API String ID: 3480331319-3965691288
Opcode ID: 7e16dae8c6c3a3f7f00df81aeaefde9d6bfcb7b26ff3ace0f9655e5be4e59e1f
Instruction ID: c73d957fa7d943d1407716d30a96acc6cb7798db8c22ab7e50ae74bedcdbb401
Opcode Fuzzy Hash: 7e16dae8c6c3a3f7f00df81aeaefde9d6bfcb7b26ff3ace0f9655e5be4e59e1f
Instruction Fuzzy Hash: 7B419574E00208ABEF10EF68C895ADF7FA6BF45324F148159E8185B392D771EE85CB91

Function 006C0708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000000B8,000002C0,00000002,00000000,00000000,00000000,00000000,000002C0,00000002,00000001,00000000,00000000,?,?,006A8B57), ref: 006C0763
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006A8B57,00000000), ref: 006C0781
RegEnumKeyExW.ADVAPI32(00000000,000000B8,000002C0,00000002,00000000,00000000,00000000,00000000,000002C0,00000003,?,?,006A8B57,00000000,00000000,00000000), ref: 006C07D7

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C07A7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3237223240
Opcode ID: da47d1c5b3065239022042347fcd3ee5774f5673c6b0d976d76d0ad29fbea7bf
Instruction ID: 8725493e3fa91ca37d6f6b2ebe2259908b7e5493d537304af56dd49fc0d391bd
Opcode Fuzzy Hash: da47d1c5b3065239022042347fcd3ee5774f5673c6b0d976d76d0ad29fbea7bf
Instruction Fuzzy Hash: AD316076902129FBFB118B94CD84FBFB76EEF04754F118169F901AB210D6349E009AB4

Function 006B39BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\adguard\setup.exe,00000104), ref: 006B39F8
_free.LIBCMT ref: 006B3AC3
_free.LIBCMT ref: 006B3ACD

Strings

C:\Users\user\AppData\Local\Temp\adguard\setup.exe, xrefs: 006B39EF, 006B39F6, 006B3A25, 006B3A5D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\adguard\setup.exe
API String ID: 2506810119-1164314936
Opcode ID: e84eb885cda568083657a6484f8a8db3815445a07ded819e69da3c6df2939696
Instruction ID: 4e1ce87c2d9a2c08c5deaf3347ff76682e4641b441500b6ee632f2c7c652050f
Opcode Fuzzy Hash: e84eb885cda568083657a6484f8a8db3815445a07ded819e69da3c6df2939696
Instruction Fuzzy Hash: C43161B1B00368ABCB21DF999C85DEEBBFEEB85710B20406AE84497311D7719F81CB54

Function 006C3B71 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C3C72: FindFirstFileW.KERNEL32(006A8F6B,?,00000001,00000000,00000000), ref: 006C3CAD
Part of subcall function 006C3C72: FindClose.KERNEL32(00000000), ref: 006C3CB9

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,?,?,?,?,00000001,00000000), ref: 006C3C64

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

Part of subcall function 006C0AB4: RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,000000B8,00000000,00000000,000000B8,BundleUpgradeCode,000002C0,000000B8,00000000,00000000,?,00696FDF,00000100,000000B0), ref: 006C0ADC
Part of subcall function 006C0AB4: RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,?,?,00696FDF,00000100,000000B0,00000088,00000410,000002C0,00000100), ref: 006C0B13

Strings

PendingFileRenameOperations, xrefs: 006C3BCF
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 006C3BA3
\, xrefs: 006C3BED

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\
API String ID: 3397690329-2982801162
Opcode ID: 375d1782bb594d6b6d56e293ca4508998b2051c3da64bc2c6deedfb2cd56796a
Instruction ID: 806626eac73a9a21c60200457127243a93e8706e99b987be602b10e7ac41ff46
Opcode Fuzzy Hash: 375d1782bb594d6b6d56e293ca4508998b2051c3da64bc2c6deedfb2cd56796a
Instruction Fuzzy Hash: E2315C31A00229AADF21AF94C941EFEBBBAEB14B50F14C16EE501B6351D7319B40CB50

Function 006A8857 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

RegCloseKey.ADVAPI32(00000000,00000000,00000100,00000000,000000B8,000002C0,00020019,00000000,000000B8,00000000,?,?,?,006A8B93,00000000,00000000), ref: 006A8914

Strings

Failed to initialize package from related bundle id: %ls, xrefs: 006A88FA
Failed to ensure there is space for related bundles., xrefs: 006A88C7
Failed to open uninstall key for potential related bundle: %ls, xrefs: 006A8883

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: e2c5544d1fccbda4fbd8fc14b94efef0a31be50ae0f4ecc5f08505eea9474488
Instruction ID: ea71e31f428f494717237c647748deaa71225e1dd7f0c82ea112c0a0520f7640
Opcode Fuzzy Hash: e2c5544d1fccbda4fbd8fc14b94efef0a31be50ae0f4ecc5f08505eea9474488
Instruction Fuzzy Hash: 96219D72900219FFDF12AE94CC06BFE7B7AEB01710F104065F900A6250DB759E60EB95

Function 00683BA1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,0068146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,006813B0), ref: 00683BBF
HeapReAlloc.KERNEL32(00000000,?,0068146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,006813B0,000001C7,00000100,?,80004005,00000000), ref: 00683BC6

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

Part of subcall function 00683C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,006822D5,000001C7,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683C67
Part of subcall function 00683C5F: HeapSize.KERNEL32(00000000,?,006822D5,000001C7,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 00683C6E

_memcpy_s.LIBCMT ref: 00683C12

Strings

c:\agent\_work\66\s\src\libs\dutil\memutil.cpp, xrefs: 00683C53

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\66\s\src\libs\dutil\memutil.cpp
API String ID: 3406509257-1758765531
Opcode ID: 7c8ea9a9a6b67330744bec74162c32bc9766beb673bfa4bd5b3b345e5965469c
Instruction ID: 371be42796e8a9ad4d53b3a29b604843f157ff908a0fb5d65e35529722848543
Opcode Fuzzy Hash: 7c8ea9a9a6b67330744bec74162c32bc9766beb673bfa4bd5b3b345e5965469c
Instruction Fuzzy Hash: 81113332600178ABCF217EA8DD45CAE3A1BEF40F20B058718F814AB351C771CF209394

Function 006C8109 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006C814D
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006C8175
GetLastError.KERNEL32 ref: 006C817F

Strings

c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp, xrefs: 006C81A0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp
API String ID: 1528435940-2024166147
Opcode ID: 6c200a39437d8ee68bad19e0a4edc966b271a78a49e1226b623a6c6cf711c49d
Instruction ID: ff50f8b6fbcc92d946069abcef2c53b5e09af75dcf5f5942112d56c0c3f90a31
Opcode Fuzzy Hash: 6c200a39437d8ee68bad19e0a4edc966b271a78a49e1226b623a6c6cf711c49d
Instruction Fuzzy Hash: 9E118473A0122AABE720DAE9CD45FBFB7E9EB04794F110519EE01FB240E6249D0586E5

Function 006C002E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(006A1074,00000000,00000000,?,?,?,006BF8EB,006A1074,006A1074,?,00000000,0000FDE9,?,006A1074,8007139F,Invalid operation for this state.), ref: 006C0040
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,006BF8EB,006A1074,006A1074,?,00000000,0000FDE9,?,006A1074,8007139F), ref: 006C007C
GetLastError.KERNEL32(?,?,006BF8EB,006A1074,006A1074,?,00000000,0000FDE9,?,006A1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 006C0086

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 006C00B7

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-727082060
Opcode ID: 4562b4733289d3602ead6458edd809f6bf41fa90ddc5e91b86868b6bcf9cd6c4
Instruction ID: 510061d5d47bd29087e8dd1347a3a5a210dbd525827cf46ac506c83c8c236142
Opcode Fuzzy Hash: 4562b4733289d3602ead6458edd809f6bf41fa90ddc5e91b86868b6bcf9cd6c4
Instruction Fuzzy Hash: 2111C672701225EBE7209AB58C44FFF7A6BEB41BA1B120318FD01E7241D6609D4086F1

Function 00681206 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(?,?,?,?,00000000,?,ignored ,00000000), ref: 00681244
GetLastError.KERNEL32 ref: 0068124E

Strings

c:\agent\_work\66\s\src\libs\dutil\apputil.cpp, xrefs: 0068126F
ignored , xrefs: 00681213

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: c:\agent\_work\66\s\src\libs\dutil\apputil.cpp$ignored
API String ID: 3459693003-1283515844
Opcode ID: e6a9070394660ac4db71111445e0f6fae7a3cd8f5e2b9dc658df0aa541f9afdc
Instruction ID: 6c2f990721f8504f02581ea7c18c130e457d1fcbe43a8069638e2a7678bf656a
Opcode Fuzzy Hash: e6a9070394660ac4db71111445e0f6fae7a3cd8f5e2b9dc658df0aa541f9afdc
Instruction Fuzzy Hash: 8C118F76901129AB8B21EB99C915DDEBBBEEF45B50B014259FD00EB210E7709F41CBA4

Function 006BF6FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,?,00000000,20000064,?,?,?,006BFDC0,?,?,?,20000064,00000001), ref: 006BF71C
GetLastError.KERNEL32(?,?,?,006BFDC0,?,?,?,20000064,00000001,?,00685651,?,?,00000000,?), ref: 006BF728
LocalFree.KERNEL32(00000000,?,?,?,00000002,?,?,?,006BFDC0,?,?,?,20000064,00000001,?,00685651), ref: 006BF791

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 006BF747

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-727082060
Opcode ID: 46fa65022a21d93b881e26665669174565c5507eb63cca11b858d893222d595d
Instruction ID: 71833375fa847bcdb38d8342fdf9e07dcb8c8e438d5acb99efebda353168db5c
Opcode Fuzzy Hash: 46fa65022a21d93b881e26665669174565c5507eb63cca11b858d893222d595d
Instruction Fuzzy Hash: 3C11BF72600129FBDB219F90ED05EEE7A6AEF54750F0180B9FD01A6270DA308E91D7A0

Function 006ACE8D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,759230D0,?,?,006AD0C2,00000000,00000000,00000000,00000000), ref: 006ACE9D
ReleaseMutex.KERNEL32(?,?,006AD0C2,00000000,00000000,00000000,00000000), ref: 006ACF24

Part of subcall function 006839DF: GetProcessHeap.KERNEL32(?,000001C7,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F0
Part of subcall function 006839DF: RtlAllocateHeap.NTDLL(00000000,?,0068237C,?,00000001,80004005,8007139F,?,?,006BFB39,8007139F,?,00000000,00000000,8007139F), ref: 006839F7

Strings

Failed to allocate memory for message data, xrefs: 006ACEEC
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 006ACEE2

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 2993511968-3819074818
Opcode ID: 75d23ea3e60cb9ad26dfe5769750003d90f46dacfa4734676eaaf56ca5eb0d6e
Instruction ID: c87f3de31e8b1bc97a2a81dd2ae8980f692f3ad2e7ae951471a5f0e480e40920
Opcode Fuzzy Hash: 75d23ea3e60cb9ad26dfe5769750003d90f46dacfa4734676eaaf56ca5eb0d6e
Instruction Fuzzy Hash: B01191B1300215AFCB159F68EC95EA6B7E6FF0A724B144279F9059B361C771AC10CFA8

Function 006C45C9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,00690458,00000000,?,0068F49C,?,00000080,?,00000000), ref: 006C45E1
GetLastError.KERNEL32(?,0068F49C,?,00000080,?,00000000,?,00690458,?,?), ref: 006C45EE
CloseHandle.KERNEL32(00000000,00000000,?,0068F49C,?,0068F49C,?,00000080,?,00000000,?,00690458,?,?), ref: 006C4642

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C4612

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-1688708105
Opcode ID: a4524ae7cfe4fa1bfea9fc248e68c7ff86aac99a54d0e6d005cd87ace5d23533
Instruction ID: 71dc4aaa9a2a38d284e6bfb9abfa2f940ce8315e2235ae860ef72490c392df30
Opcode Fuzzy Hash: a4524ae7cfe4fa1bfea9fc248e68c7ff86aac99a54d0e6d005cd87ace5d23533
Instruction Fuzzy Hash: 7101D43364112567DB219AAA9C15FBA3A57DB52BB4F020218FE20AB2D0CB21CC0196E9

Function 006C4199 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000000B8,00000000,?,006A89B4,00000000,00000100,000000B8,BundleCachePath,00000000), ref: 006C41CD
GetLastError.KERNEL32(?,006A89B4,00000000,00000100,000000B8,BundleCachePath,00000000,000000B8,BundleVersion,000002C8,000000B8,EngineVersion,000000B8,000002C0), ref: 006C41DA

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C41AE, 006C41FE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-1688708105
Opcode ID: f5804ae65972bacd554d782f7f7dfa2be448b245c80b3915c7d432a2fc199070
Instruction ID: 510cff96de55f37f2daad152b6dd7f54e80e9619303a32eb2067ea05f8e518d6
Opcode Fuzzy Hash: f5804ae65972bacd554d782f7f7dfa2be448b245c80b3915c7d432a2fc199070
Instruction Fuzzy Hash: 2201F932681235B7E73166989C2AFBA299BDB11BB0F114119FE40BF2D1CA694D0152E9

Function 006906B6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,00000001,00000000,?,?,00020006,00000000,?,00000000), ref: 00690726

Strings

Failed to update resume mode., xrefs: 006906F7
Failed to update name and publisher., xrefs: 00690710
Failed to open registration key., xrefs: 006906DD

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 80fb7e7f1ce0a77809bf5ad25fcd0343d2200df1b2fefd089c3a5a674db13793
Instruction ID: 596906f73687c7dd393a76c2b7f7671d732baeff4e33b4e3a42ed6f4e87a4b0d
Opcode Fuzzy Hash: 80fb7e7f1ce0a77809bf5ad25fcd0343d2200df1b2fefd089c3a5a674db13793
Instruction Fuzzy Hash: B401D432A40228FBEF125A94CC16FAE7B6FEF00764F100115F500BA291D7B1AE10ABC4

Function 006C3183 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006C31C8
SysFreeString.OLEAUT32(00000000), ref: 006C31FB

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C3199, 006C31DF
`)u, xrefs: 006C31FB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-176205067
Opcode ID: 4d18a7ed5f31acd5428de239588f71a98aa7cbae9319a36028d622da10ba3553
Instruction ID: c7b45124f50c5136b386c6fb15308aa0e5874271f3d8104cfcb63bc97d60aeb9
Opcode Fuzzy Hash: 4d18a7ed5f31acd5428de239588f71a98aa7cbae9319a36028d622da10ba3553
Instruction Fuzzy Hash: 3001F271245369ABEB201A654C09FBA36ABDF80B65F14803DFD05EB740C678CE058695

Function 0069EB14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 0069EB3C
GetLastError.KERNEL32 ref: 0069EB46

Strings

Failed to post elevate message., xrefs: 0069EB74
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069EB6A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post elevate message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-3565835173
Opcode ID: 9d2b9cc42e723de882c615bd7ea0ca07426ef0780f443cbfce5611be592a467a
Instruction ID: 4cee8bf9128da41b3c9acb38a2d8ec45982569dd9610f26345d70b58f635da94
Opcode Fuzzy Hash: 9d2b9cc42e723de882c615bd7ea0ca07426ef0780f443cbfce5611be592a467a
Instruction Fuzzy Hash: 31F0FC33A51235A7C72096945D05E97778A6F05B74F124229FE15EF3D1D7268C0183D4

Function 0068D88A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 0068D8B1
FreeLibrary.KERNEL32(?,?,00684920,?), ref: 0068D8C0
GetLastError.KERNEL32(?,00684920,?), ref: 0068D8CA

Strings

BootstrapperApplicationDestroy, xrefs: 0068D8A9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: e53b1cd9a9b888763585b519980b184c87937f9282c03391f718fe7a15ad5082
Instruction ID: c5cce25586972a7539ff05e48ed56d833badfadfeaadaa40510cbc418dd942e7
Opcode Fuzzy Hash: e53b1cd9a9b888763585b519980b184c87937f9282c03391f718fe7a15ad5082
Instruction Fuzzy Hash: 5CF0627260062AABC7106FA5E804F66F7A6FF007667058329E815D7690C725EC50DBE4

Function 006C2A57 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006C2A6C
SysFreeString.OLEAUT32(00000000), ref: 006C2A9C

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C2A80
`)u, xrefs: 006C2A9C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-176205067
Opcode ID: b79ab0662d67aa3fc015f8e8cc26468ec74094dfd4e59366060deab47ae99d73
Instruction ID: c94cc25c03639e79834e466eeb5f29bf9ced621605f291362bce57db2a868c94
Opcode Fuzzy Hash: b79ab0662d67aa3fc015f8e8cc26468ec74094dfd4e59366060deab47ae99d73
Instruction Fuzzy Hash: A2F09A312426AAEBC7315A809C18FBB77A7EF80B61F25402DFC08AB310C7748D119AA5

Function 006C2CFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006C2D11
SysFreeString.OLEAUT32(00000000), ref: 006C2D41

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 006C2D28
`)u, xrefs: 006C2D41

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-176205067
Opcode ID: c7ae62274b86aaa6a00769a5fb6248f0f702e88faedb8187d086e35573435a52
Instruction ID: c11249d58fb62496d2187c2f6c39364d26708efd50f83248be47efba6d398bcd
Opcode Fuzzy Hash: c7ae62274b86aaa6a00769a5fb6248f0f702e88faedb8187d086e35573435a52
Instruction Fuzzy Hash: ACF0B432142256A7C7225F449C18FBA7B6AEF90761F11401DFC099B320C774ED019AA1

Function 0069F11E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 0069F133
GetLastError.KERNEL32 ref: 0069F13D

Strings

Failed to post plan message., xrefs: 0069F16B
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069F161

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-4270167399
Opcode ID: de031f3320f90dcec0186e1f016a9024c993c298a007814290a5b28b416dba6e
Instruction ID: c14691befae743c9684a6aaa7d1f0c3693e0f2ebd9c66bec92d2874093f756ca
Opcode Fuzzy Hash: de031f3320f90dcec0186e1f016a9024c993c298a007814290a5b28b416dba6e
Instruction Fuzzy Hash: FCF0A733A51235ABD72067A5DC09D877E8AAF05BB0B130025FD48EE391E5259C0082E9

Function 0069F22C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 0069F241
GetLastError.KERNEL32 ref: 0069F24B

Strings

Failed to post shutdown message., xrefs: 0069F279
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069F26F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-519151043
Opcode ID: 6e4f091c3d187da618c4112c25d8b3ede5d05744d3a1a42bd55f4e81157f4626
Instruction ID: b93333ba2fbb1d4025dbae984744b1fe64ca5e37d703a7f9140c229020c77b55
Opcode Fuzzy Hash: 6e4f091c3d187da618c4112c25d8b3ede5d05744d3a1a42bd55f4e81157f4626
Instruction Fuzzy Hash: 2EF0A737A5523567972017E55C09F877A4AAF05F60B034036FE04FE390E5149D0086E4

Function 006A0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,006A14B9,?,00000000,BTh,0068C24A,?,BTh,?,00697498,?,?,00685442,?), ref: 006A056E
GetLastError.KERNEL32(?,006A14B9,?,00000000,BTh,0068C24A,?,BTh,?,00697498,?,?,00685442,?,00685482,00000001), ref: 006A0578

Strings

Failed to set begin operation event., xrefs: 006A05A6
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 006A059C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-3321223842
Opcode ID: 858a560712c004e24284746be18c7fb61d98d8125d883c5894a277ee0633767f
Instruction ID: 030f52ef94b74849abde80c8eabb614c9a04f295a0b94283d6403bf131b86074
Opcode Fuzzy Hash: 858a560712c004e24284746be18c7fb61d98d8125d883c5894a277ee0633767f
Instruction Fuzzy Hash: D7F0A773D4263527532032A55E05ADB778B9F07BA1B020129FE00BB341F6699D004EE9

Function 0069EA1A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 0069EA2F
GetLastError.KERNEL32 ref: 0069EA39

Strings

Failed to post apply message., xrefs: 0069EA67
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069EA5D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post apply message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-1324423724
Opcode ID: 019905104a85d1e07e09a4f6cfacc67856e4b7ec72c5f57a343929fe3bc7becf
Instruction ID: de11dbde1b08190ce831294e21f9f74658a402e00d3abe2fd084d0441944cd20
Opcode Fuzzy Hash: 019905104a85d1e07e09a4f6cfacc67856e4b7ec72c5f57a343929fe3bc7becf
Instruction Fuzzy Hash: C2F0A733A412356B972156A55C09D8BBE8ABF05BA0B030125FD08FE3A1E5159C0086E9

Function 0069EAAB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 0069EAC0
GetLastError.KERNEL32 ref: 0069EACA

Strings

Failed to post detect message., xrefs: 0069EAF8
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0069EAEE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-2517332631
Opcode ID: f2f017240151d0d31aff6d0eacd2b9409eacc6fd78b50c9520410a311abcc168
Instruction ID: 0dd7da22fa73738bfa80cbf035f212f4c94199a79f0e6fd7435c10272c249f22
Opcode Fuzzy Hash: f2f017240151d0d31aff6d0eacd2b9409eacc6fd78b50c9520410a311abcc168
Instruction Fuzzy Hash: FBF0A733A512357797205AA55D09E977F9AAF05BA1B030019FE08FE390D515DC00C2E8

Function 006B63C9 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006B6454
__alldvrm.LIBCMT ref: 006B6655
__alldvrm.LIBCMT ref: 006B6677

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction ID: ae4b48aaa187d01871c555342ecc461f24761ec3d174ef9051c2ef50a66cc4f8
Opcode Fuzzy Hash: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction Fuzzy Hash: 7BA136B29006869FDB21CF28C881BEABBE2EF55310F1841ADF5859B381D63C9D81CB55

Function 006C56B4 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 006C5781
lstrlenW.KERNEL32(00000000), ref: 006C5799

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 006C5822

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 1659193697-16760509
Opcode ID: f4db9fb7f9954f9930ef6bc030ce62e0160dc94f6b7662b1f0282a945bdad936
Instruction ID: f35a530c6d628d0dadde64fbbed831de1ab036cb46df1b2d2ec1b849cd2d6c0e
Opcode Fuzzy Hash: f4db9fb7f9954f9930ef6bc030ce62e0160dc94f6b7662b1f0282a945bdad936
Instruction Fuzzy Hash: EA517272D01629EFDB119FA58C84EFF7BBAEF88750B155118F902A7210D774ED818BA0

Function 006C8352 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006C846B

Strings

c:\agent\_work\66\s\src\libs\dutil\uriutil.cpp, xrefs: 006C848C
Wl, xrefs: 006C8394
<, xrefs: 006C83BC

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLast
String ID: Wl$<$c:\agent\_work\66\s\src\libs\dutil\uriutil.cpp
API String ID: 1452528299-203588407
Opcode ID: ff292fad002aa61d31d224e36abcd910ab53d00ab8bd6b65267f4df10b7990a7
Instruction ID: d92626c43a6cb66e8e034eddad76c3051f775ceebbeebd0af0cac6c422acd984
Opcode Fuzzy Hash: ff292fad002aa61d31d224e36abcd910ab53d00ab8bd6b65267f4df10b7990a7
Instruction Fuzzy Hash: 4751FA71D012399BCB35DF55CC88AD9B7FAEF08710F4141EAA908A7301DB709E948F95

Function 00684FE1 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?), ref: 0068503B
DeleteCriticalSection.KERNEL32(?,?,?), ref: 0068504F
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0068513E
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00685145

Part of subcall function 0068115F: LocalFree.KERNEL32(?), ref: 00681169

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 2168c0a18ed068abfc4f49408de099713888a74b51c98903a466bd98e7c58a45
Instruction ID: 4659912e76bfab59ea1fb6adbe6c917430b65e98451b74fd77153f9a3ff33f4a
Opcode Fuzzy Hash: 2168c0a18ed068abfc4f49408de099713888a74b51c98903a466bd98e7c58a45
Instruction Fuzzy Hash: 08410CB1500B059BDAA0FBB1C889FDB73EEAF04700F444A1EB29AD3151DB34E544C728

Function 00684CC9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0068F90C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,?,?,?,00684CE8,?,?), ref: 0068F95C

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00684D4F

Strings

Unable to get resume command line from the registry, xrefs: 00684CEE
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00684D39
Failed to get current process path., xrefs: 00684D0D

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: b8fa357819e1eff8c8f7e842edd78db6a701eb00be3d7851efa3e10d585fb6b8
Instruction ID: fb211a39258365bbfe4ef359ca99a1d06492ed9f67d1741784050cf9157c707d
Opcode Fuzzy Hash: b8fa357819e1eff8c8f7e842edd78db6a701eb00be3d7851efa3e10d585fb6b8
Instruction Fuzzy Hash: A8118171D01219FACF22BBA4DC01DEEFBBAEF50700B11426AF811B6211EB709B40DB80

Function 006B815F Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006B8303,00000000,00000000,?,006B8106,006B8303,00000000,00000000,00000000,?,006B8303,00000006,FlsSetValue), ref: 006B8191
GetLastError.KERNEL32(?,006B8106,006B8303,00000000,00000000,00000000,?,006B8303,00000006,FlsSetValue,006E1A28,FlsSetValue,00000000,00000364,?,006B59FB), ref: 006B819D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006B8106,006B8303,00000000,00000000,00000000,?,006B8303,00000006,FlsSetValue,006E1A28,FlsSetValue,00000000), ref: 006B81AB

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 3b3ca14f25ce9d40031c26ab1a168c9a266586d0477a16b6c8cdea209d464ee3
Instruction ID: 034cf8f02916e846cdacd69e7a2babd4868e6523b6d8ad1d51bac81a2d5071d4
Opcode Fuzzy Hash: 3b3ca14f25ce9d40031c26ab1a168c9a266586d0477a16b6c8cdea209d464ee3
Instruction Fuzzy Hash: 1101D4B6646327AFC7214A6CAC44EE7779EAF057A1B140620EE15E7380DF21D842C7F0

Function 0068743E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0068744A
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 006874B1

Strings

Failed to get value of variable: %ls, xrefs: 00687484
Failed to get value as numeric for variable: %ls, xrefs: 006874A0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: 2ee75b87aa767811d0c1116f9212b86f92cea1925b51fe17b8270a3145a27041
Instruction ID: 8803eba52a0e9ca3218d92e77590ce49d8042237e2cecca35ea75f0d27320ba8
Opcode Fuzzy Hash: 2ee75b87aa767811d0c1116f9212b86f92cea1925b51fe17b8270a3145a27041
Instruction Fuzzy Hash: BC015E72944128BBCF11AF54CC06A9EBEA7AF10765F218224FD14AA221D335DE1097D5

Function 006874BE Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0069258D,?,WixBundleLayoutDirectory,00000001,?,00000000), ref: 006874CA
LeaveCriticalSection.KERNEL32(00000000,00000000,?,00000000,?,0069258D,?,WixBundleLayoutDirectory,00000001,?,00000000), ref: 00687531

Strings

Failed to get value of variable: %ls, xrefs: 00687504
Failed to get value as string for variable: %ls, xrefs: 00687520

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2100416246
Opcode ID: de6293f09b964d3918009383624c6adb2c73acba05d0fc70a00d200bd19e6026
Instruction ID: 0151542cf61c57e0f30297286ccb7b3715beeb16994b3d6b3894c6a1fe91cd01
Opcode Fuzzy Hash: de6293f09b964d3918009383624c6adb2c73acba05d0fc70a00d200bd19e6026
Instruction Fuzzy Hash: 2401BC72914128BBCF12BF94CC09E9E7A67EF08768F214224FD04AA220C775DE109B96

Function 006875AD Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006875B9
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00687620

Strings

Failed to get value of variable: %ls, xrefs: 006875F3
Failed to get value as version for variable: %ls, xrefs: 0068760F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: ae5b5453cde34e343871d7c2727f6ce490a11a72b983b5329adb690aaa55da8c
Instruction ID: f23885daf6d4a30b30090ce855cc5bb1389a709b73a91e59dba938290dffbfa1
Opcode Fuzzy Hash: ae5b5453cde34e343871d7c2727f6ce490a11a72b983b5329adb690aaa55da8c
Instruction Fuzzy Hash: 7F01D472904528FBCF117F44CC09E9E3B26EF10728F214265FD00A6221D735DE509BE5

Function 0068753E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,0068985C,00000000,?,00000000,00000000,00000000,?,0068969D,00000000,?,00000000,00000000), ref: 0068754A
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,0068985C,00000000,?,00000000,00000000,00000000,?,0068969D,00000000,?,00000000), ref: 006875A0

Strings

Failed to get value of variable: %ls, xrefs: 00687570
Failed to copy value of variable: %ls, xrefs: 0068758F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: f2b1159434f15ca8d786f0e77ba851dff2ce96dc6f105ea44748597e72985d24
Instruction ID: 7a4dec92502f0096209a09758980246759cd808936af4091d2f49cb9f188c116
Opcode Fuzzy Hash: f2b1159434f15ca8d786f0e77ba851dff2ce96dc6f105ea44748597e72985d24
Instruction Fuzzy Hash: 5FF0A472904228BBCF027F94DC05EDE3B2AEF14364F118124FC04A6221C735DA109B95

Function 006BDC03 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,006BD5DF), ref: 006BDC26

Strings

tOn, xrefs: 006BDCD8
8j, xrefs: 006BDC9C, 006BDD36, 006BDDEE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: DecodePointer
String ID: 8j$tOn
API String ID: 3527080286-733542103
Opcode ID: 69ae74768e471ee11146785e1addfd7ec8d612f5640bc9a08d88174c493ecf7e
Instruction ID: da6d94c715edc95f41c17c967a7cbd7620984ffbcb0c490d7568ae15f5f4df0c
Opcode Fuzzy Hash: 69ae74768e471ee11146785e1addfd7ec8d612f5640bc9a08d88174c493ecf7e
Instruction Fuzzy Hash: C2517CB090060DCBCF10DF69E9485ECBFB6FF49304F650194D481AE264EB758D95CB58

Function 006C0517 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 006C0692

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C067F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Close
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3535843008-3237223240
Opcode ID: 1075725450772c840294789575816107a90da70fc3d70de2d43d5fc3ee3e3166
Instruction ID: 862aa8024851ad79182f9dd922bac9eda75d646a1cec20a2f3d9268b76b0764f
Opcode Fuzzy Hash: 1075725450772c840294789575816107a90da70fc3d70de2d43d5fc3ee3e3166
Instruction Fuzzy Hash: B741A232D01125EBEF219E9ACD04FFE7A63EB80760F15822EE915AB250D7358D609B94

Function 006C7ED3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006C7FE0
GetLastError.KERNEL32 ref: 006C7FEA

Strings

c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp, xrefs: 006C800E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp
API String ID: 2781989572-1799797844
Opcode ID: 950590249f72ab8b879aea3d815dfc02cca46b78d3bcc7416fc17327310dab49
Instruction ID: 4d55bf887a41dbd03f09057d8a0fdf7b6ad4616782db3fa534036507ab1d6741
Opcode Fuzzy Hash: 950590249f72ab8b879aea3d815dfc02cca46b78d3bcc7416fc17327310dab49
Instruction Fuzzy Hash: 94412576F182166ADB30ABB88C85FFEB667EF50701F04411DF502B7280D675CE408BA5

Function 006C3FBE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,?,00000000,?), ref: 006C411F

Strings

PendingFileRenameOperations, xrefs: 006C400F, 006C40F7
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 006C3FCF

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: d855d1617d182af64b575a3e479c6d76add6436e608d55434c05d8877dcc4bdb
Instruction ID: 0603eac9232f0a5dd8df18d7ab0b19762923cfdbb2689d11e840a5db0efa2f3e
Opcode Fuzzy Hash: d855d1617d182af64b575a3e479c6d76add6436e608d55434c05d8877dcc4bdb
Instruction Fuzzy Hash: 67416B71E40219EBCB20EF94C9A1EFEBBB7EB54750F15406DEA01A7211DB319E81CB50

Function 006C8B19 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C85F6: lstrlenW.KERNEL32(00000100,?,?,?,006C8996,000000B8,00000001,00000001,00000100,?,?,?,006A7AD3,?,?,000000BD), ref: 006C861B

RegCloseKey.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?), ref: 006C8BFE
RegCloseKey.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?), ref: 006C8C18

Part of subcall function 006C04A5: RegCreateKeyExW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,006905B1,00000000,00000000,00020006), ref: 006C04CA

Part of subcall function 006C0D87: RegSetValueExW.ADVAPI32(00020006,006CFF38,00000000,00000001,?,?,?,000000FF,?,00000000,?,?,0068F2DF,?,?,00020006), ref: 006C0DBA

Part of subcall function 006C0D87: RegDeleteValueW.ADVAPI32(00020006,006CFF38,00000000,?,?,0068F2DF,?,?,00020006,?,006CFF38,00020006,?,?,?,00000000), ref: 006C0DEA

Part of subcall function 006C0D39: RegSetValueExW.ADVAPI32(00000000,00000005,00000000,00000004,?,00000004,?,?,0068F237,006CFF38,Resume,00000005,00000000,00000000,00000000,00000000), ref: 006C0D4E

Strings

%ls\%ls, xrefs: 006C8B7A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: 919d731ae8983a12cdc3a45fba1553e0557bacc77f34fc70df275acfaa1d5958
Instruction ID: 4139983250de9b0ce2a831dacc77ffd40ad3cd83d949692f80f96cecc35ae80b
Opcode Fuzzy Hash: 919d731ae8983a12cdc3a45fba1553e0557bacc77f34fc70df275acfaa1d5958
Instruction Fuzzy Hash: A4310C76C0116AEF8F229FD4CD80DAEBBBAEF14750B11416AE90077121DB319E51DBA4

Function 00693A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00693F3C,?,?,00000000,?,?,?,00684B57), ref: 00693ACD

Part of subcall function 006C095E: RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,00000000,00000088,000000B8,00000088,00000002,000000B8,BundleUpgradeCode,000002C0,00000088,000000B8,00000000), ref: 006C09D4
Part of subcall function 006C095E: RegQueryValueExW.ADVAPI32(?,00000088,00000000,?,00000088,00000088,00000088,?), ref: 006C0A0C

Strings

Logging, xrefs: 00693A5A
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00693A43

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 2d98f88129eeb28ccc282a52f4bde4c8d991fe5294fef99dd33334b91ca3c734
Instruction ID: 8725625529e7db1ed6285c9097988293b7327c042758681154ce4cbaa11b8e4a
Opcode Fuzzy Hash: 2d98f88129eeb28ccc282a52f4bde4c8d991fe5294fef99dd33334b91ca3c734
Instruction Fuzzy Hash: 1711263660022AFBEF24DA81DD06FFAB77FAB00714F500159E981EB390C6708F418750

Function 006C0D87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,006CFF38,00000000,00000001,?,?,?,000000FF,?,00000000,?,?,0068F2DF,?,?,00020006), ref: 006C0DBA
RegDeleteValueW.ADVAPI32(00020006,006CFF38,00000000,?,?,0068F2DF,?,?,00020006,?,006CFF38,00020006,?,?,?,00000000), ref: 006C0DEA

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 006C0E1E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Value$Delete
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 1738766685-3237223240
Opcode ID: 137d2234d9fdafd2fd204ab219e86a632491d60618fa53664339284ff3aab4ca
Instruction ID: bcc0b601279e9c15395ce26f4e336328d5059146a985f3a96e48c8d57952c4a2
Opcode Fuzzy Hash: 137d2234d9fdafd2fd204ab219e86a632491d60618fa53664339284ff3aab4ca
Instruction Fuzzy Hash: 08118F3798127AF7FB215A948D05FFFAA67EB08760F114528FE01BA290D620ED1097E0

Function 0068DD59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,006A73ED,00000000,IGNOREDEPENDENCIES,00000000,?,?), ref: 0068DDAA

Strings

IGNOREDEPENDENCIES, xrefs: 0068DD61
Failed to copy the property value., xrefs: 0068DDDE

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 2a403423f89b4bf6b7a49dace041241dc86b411e4aa3f0f1b6f6f79a007ab0e3
Instruction ID: 081961810937b3ca2fd3d6eed11480100415b515bec7c54ff16de512935a928c
Opcode Fuzzy Hash: 2a403423f89b4bf6b7a49dace041241dc86b411e4aa3f0f1b6f6f79a007ab0e3
Instruction Fuzzy Hash: CA118632204215AFDB11AF54CC95FA9B7A7EF04324F254375FA189B3E1CB709850C7A4

Function 00681578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,?,?,?,?,?,?,?,?), ref: 006815BC
GetLastError.KERNEL32 ref: 006815C6

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 006815EA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorLastString
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3728238275-792799584
Opcode ID: c74f41380467eb0960e99fbbb54e62647d206398a5b0fa7fa3a32510536adcb9
Instruction ID: a0f57cdca210129d56601afb1cafd259b107a929b3551d31cc70a64b6eb009ed
Opcode Fuzzy Hash: c74f41380467eb0960e99fbbb54e62647d206398a5b0fa7fa3a32510536adcb9
Instruction Fuzzy Hash: E601287390023667CB21AAD58C00E977B6EEF86B70B010324FE10BF240D660DC10C7E2

Function 0069573C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00695759
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 006957B2

Strings

Failed to initialize COM on cache thread., xrefs: 0069576E

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 6826da92f9d7a5514680e25a7711f5b077bbee39b56476535f325166825899f7
Instruction ID: b18db02a0a3f0104bb68d835a508d89dc5115d510b539c0b7a3ecd39f156c100
Opcode Fuzzy Hash: 6826da92f9d7a5514680e25a7711f5b077bbee39b56476535f325166825899f7
Instruction Fuzzy Hash: 00016172600619BFDB059BE4DC84DEABBAEFF09354B10412AF509D7220DB70AE50CB94

Function 006C4E42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00698D6E,?,00000001,20000004,00000000,00000000,?,00000000), ref: 006C4E71
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00698D6E,?), ref: 006C4E8C

Strings

c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp, xrefs: 006C4EB0

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp
API String ID: 2352087905-2024494872
Opcode ID: 99dbe96285cc2fa5b772bd00d220d95cb4140120e3af804d30a25fd3d3451855
Instruction ID: 92b99c628fbec2715f6b61d4bcf8473c6a5bea01056cb064a01318d8f269675d
Opcode Fuzzy Hash: 99dbe96285cc2fa5b772bd00d220d95cb4140120e3af804d30a25fd3d3451855
Instruction Fuzzy Hash: D9015E73901229EBCF229E99CD15EEE7E77FF48B61F034219FE0466210C6319D209B94

Function 006B8397 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,BCE85006,00000001,?,000000FF), ref: 006B8408

Strings

LCMapStringEx, xrefs: 006B83A8, 006B83B2
8j, xrefs: 006B83E4

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: String
String ID: 8j$LCMapStringEx
API String ID: 2568140703-2927457948
Opcode ID: 1856e359ed32a06864eab03afab649144ba268bb49f0a764cc535792e0236508
Instruction ID: 4bf1dd5844c551ad0b34069a1f2d9ba9206be47ee6c237ca31ec2b5223717c98
Opcode Fuzzy Hash: 1856e359ed32a06864eab03afab649144ba268bb49f0a764cc535792e0236508
Instruction Fuzzy Hash: 1801133250124DBBCF02AF90CC06EEE3FA7FF08750F054118FA086A160CA728971EB91

Function 00685160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room), ref: 0068517F
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F), ref: 006851AF

Strings

burn.clean.room, xrefs: 0068516C, 00685179, 006851A6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 1501c49916096a38e10d3fbf111e6dc4e99de343e60fbe3fc45f33bf3a4a4131
Instruction ID: 1400552e81163ac9b62b2b0e99eb5f8d2625d8fc84859aa0e45d000ff76c1f7c
Opcode Fuzzy Hash: 1501c49916096a38e10d3fbf111e6dc4e99de343e60fbe3fc45f33bf3a4a4131
Instruction Fuzzy Hash: 3B016272510B64ABD7205FCEADC8EB3BBAFEB197547100229F546C7B10C365AC50C7A2

Function 006C3448 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C0823: RegOpenKeyExW.KERNELBASE(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,0068A2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 006C0837

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,006C32E8,?), ref: 006C34B9

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 006C3463
EnableLUA, xrefs: 006C348B

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: f2a3927778acfd81c66793d221c9cf26b77cdc44bd8fb25a8b17e6aaed831b84
Instruction ID: 23293572594004f24706fc06dde43c98a82bf610aca4c87056497bbf861815b2
Opcode Fuzzy Hash: f2a3927778acfd81c66793d221c9cf26b77cdc44bd8fb25a8b17e6aaed831b84
Instruction Fuzzy Hash: 89018432D11238FBDB159AA4C90AFEDF6AADB0072AF21C169E901B7250D3785F40D7D4

Function 006C60FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 006C6160

Strings

`)u, xrefs: 006C6160
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 006C611C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeString
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 3341692771-1656310558
Opcode ID: d2af19c25baa659a7041c2e2fdc3980610739af49a577311ea9ba183bf1af31b
Instruction ID: c699c3526c24ab2da20b92f7c32f3ea62851aa20ed7ae377abd27f96d5cd5837
Opcode Fuzzy Hash: d2af19c25baa659a7041c2e2fdc3980610739af49a577311ea9ba183bf1af31b
Instruction Fuzzy Hash: 2001D132800216F6CB21AA89CD06FFEFB6BDF41B62F28411DB90476652D3748E0097A8

Function 006C608D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 006C60EC

Part of subcall function 006C7ED3: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006C7FE0
Part of subcall function 006C7ED3: GetLastError.KERNEL32 ref: 006C7FEA

Strings

`)u, xrefs: 006C60EC
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 006C60DA

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `)u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 211557998-1656310558
Opcode ID: 9ee131436dbbbef80c09a068d2cac4a0fdfeec5b7cafc9fd40805130e708baac
Instruction ID: 78f5fcdc2169a61cfc8fdc381d2dbe3706f36f3c5eb3a822ee31e641525c5049
Opcode Fuzzy Hash: 9ee131436dbbbef80c09a068d2cac4a0fdfeec5b7cafc9fd40805130e708baac
Instruction Fuzzy Hash: 50016271A01126FB8B20AF85CA41EAAFB6AFF14760B10817EF605B7211D7719E04D7E9

Function 006834C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006810DD,?,00000000), ref: 006834E5
GetLastError.KERNEL32(?,?,?,?,006810DD,?,00000000), ref: 006834FC

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00683520

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-4168559387
Opcode ID: 7cf75a49652cee4b3422aa6c1f6dbe5e986786305bf311905f1c334d9bd17878
Instruction ID: 2fa41c0ec8064a8e7d74c4599ac1a9b17adbeb1b2d69aa9892192edc44786cc7
Opcode Fuzzy Hash: 7cf75a49652cee4b3422aa6c1f6dbe5e986786305bf311905f1c334d9bd17878
Instruction Fuzzy Hash: 4DF0C273A001356787226A959C05E9BBA9BAB45FA0B060325FE04BF300D664DE0183E2

Function 00686540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00686552

Part of subcall function 006C038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00685EE0,00000000), ref: 006C039E
Part of subcall function 006C038A: GetProcAddress.KERNEL32(00000000), ref: 006C03A5
Part of subcall function 006C038A: GetLastError.KERNEL32(?,?,?,00685EE0,00000000), ref: 006C03BC

Part of subcall function 00685D14: RegCloseKey.ADVAPI32(00000000,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00685D9A

Strings

Failed to get 64-bit folder., xrefs: 00686575
Failed to set variant value., xrefs: 0068658F

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 82f7e3a60808ff39856171d379cb6756b6353876e485f01fa238b2947bbfc46b
Instruction ID: 46ff0fe9a432fb5423689d49b48d2d7722b2a180a4702c9ad9692667125de4cf
Opcode Fuzzy Hash: 82f7e3a60808ff39856171d379cb6756b6353876e485f01fa238b2947bbfc46b
Instruction Fuzzy Hash: 7E018F72800628FBCF11B7A0DC06FAEBA3ADB04725F10425AF800A6115D670AF40DB95

Function 006ADFDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 006AE902

Part of subcall function 006B0AD1: RaiseException.KERNEL32(?,?,?,$j,?,?,00000000,?,?,?,?,?,006AE924,?,006E78A8), ref: 006B0B31

__CxxThrowException@8.LIBVCRUNTIME ref: 006AE91F

Strings

Unknown exception, xrefs: 006AE92C

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b4ec120efea1d8b29a57a2753f6f27309921a168db37dc03960651d29ce2f288
Instruction ID: 85b2e7ab95a856464789050939ed07e2bd5b84027a5dc2e54f3ac188ce61a219
Opcode Fuzzy Hash: b4ec120efea1d8b29a57a2753f6f27309921a168db37dc03960651d29ce2f288
Instruction Fuzzy Hash: BBF0283490430D77CB14BA65DC059DE776E9E02300B504538F815924E2EF71DD56CA84

Function 006C4224 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,759234C0,?,?,?,0068B9EC,00000002,?,?,00000000,00000000), ref: 006C423C
GetLastError.KERNEL32(?,?,?,0068B9EC,00000002,?,?,00000000,00000000,?,?,?,?,76EDC3F0,00000000), ref: 006C4246

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 006C426A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 464720113-1688708105
Opcode ID: 4613a729693cdc15d80b90f749b92e5fff9d7828ddaa3c8e595bc8ccce9c5ce8
Instruction ID: 8b2a6cd605c3cb7c0803664525b3898913679826e50dca150b4c6f93ddc63b4e
Opcode Fuzzy Hash: 4613a729693cdc15d80b90f749b92e5fff9d7828ddaa3c8e595bc8ccce9c5ce8
Instruction Fuzzy Hash: 31F068B2901236ABD710DB85CD05DAAFBAEEF55B64B014119FD45A7340D774AE00C7D4

Function 006C35D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,?,?,00000000), ref: 006C35FE
CoCreateInstance.OLE32(?,00000000,00000001,006E6B4C,?), ref: 006C3616

Strings

Microsoft.Update.AutoUpdate, xrefs: 006C35F9

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 1fe05228cbd88f24d8eb6d4b841a235e53c4f17e12cf8d9926b16552400e8083
Instruction ID: 9984b603b6ce1a9296614b231203a58d9b72edeae648d6cf123d267afad6cea1
Opcode Fuzzy Hash: 1fe05228cbd88f24d8eb6d4b841a235e53c4f17e12cf8d9926b16552400e8083
Instruction Fuzzy Hash: C9F05471600258BBD700EBE9DD45EEFB7B9DB48754F110425FA01F7150D6B0EE048662

Function 006B8335 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,006B6F11), ref: 006B8380

Strings

8j, xrefs: 006B8370
InitializeCriticalSectionEx, xrefs: 006B8346, 006B8350

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 8j$InitializeCriticalSectionEx
API String ID: 2593887523-4044259361
Opcode ID: b4ca63d6f46b2f548c30dcb840ace23d72dfae0e1a6d0e2d882869ff5179b55a
Instruction ID: 608644fe5345187192427fe4e19546c0e7c771b35bac2ff6bb5445eee1e5d2b0
Opcode Fuzzy Hash: b4ca63d6f46b2f548c30dcb840ace23d72dfae0e1a6d0e2d882869ff5179b55a
Instruction Fuzzy Hash: 28F02431A4221CFBCB10AF95CC05DAD7FA7EF05750B010028FC0A5B220CA724E90EB94

Function 006B81DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 006B8219

Strings

8j, xrefs: 006B820F
FlsAlloc, xrefs: 006B81EB, 006B81F5

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Alloc
String ID: 8j$FlsAlloc
API String ID: 2773662609-105014566
Opcode ID: a3162ade66dacc47134d79f458b5cf48253c2f496d1359d8a4eeb5d41a29bcda
Instruction ID: 215ce2437aac2586827fa810cb4ce297c3a993c305fcd3960d8ed357a929bf5a
Opcode Fuzzy Hash: a3162ade66dacc47134d79f458b5cf48253c2f496d1359d8a4eeb5d41a29bcda
Instruction Fuzzy Hash: CEE05532A813187F8300BBA18C12EBD7B5BDF0A750B210218F8159B241CE710E40DAD6

Function 006B8230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 006B826F

Strings

FlsFree, xrefs: 006B8241, 006B824B
8j, xrefs: 006B8265

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: Free
String ID: 8j$FlsFree
API String ID: 3978063606-1103277460
Opcode ID: 8d85e9bd02f68b2f5c57e0437e05699baaa2ea8b176701810c936abb9bc9d7ba
Instruction ID: ed522d9b9df77ae1f19eb0fd15f83462ceb9a3190ac75193b3206d4e587083d4
Opcode Fuzzy Hash: 8d85e9bd02f68b2f5c57e0437e05699baaa2ea8b176701810c936abb9bc9d7ba
Instruction Fuzzy Hash: EBE0E571A422986FC700BFA59C02DBEBB5BDF06B11B45016DB9055B241EE704E0097D6

Function 006B0F0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 006B0F21

Strings

8j, xrefs: 006B0F34
FlsAlloc, xrefs: 006B0F10, 006B0F1A

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: try_get_function
String ID: 8j$FlsAlloc
API String ID: 2742660187-105014566
Opcode ID: d42790c71aa0844050c47a440bd5a590265401425480d820cfbdd9a51adee32e
Instruction ID: 08853429d692bec99fdcbbc4cb612c9d1ebd781c55f14a8c20831854634d4778
Opcode Fuzzy Hash: d42790c71aa0844050c47a440bd5a590265401425480d820cfbdd9a51adee32e
Instruction Fuzzy Hash: C2D0C23178632CF7E2102A816C06EFA7E87D700BB6F050061FA0C5128285A5488183C2

Function 006BF699 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(75070000,00000001,006855C7,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006BF6A6
FreeLibrary.KERNEL32(00000000,00000001,006855C7,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006BF6C8

Strings

`+>s, xrefs: 006BF6B8

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: FreeLibrary
String ID: `+>s
API String ID: 3664257935-2796796645
Opcode ID: 1819b4c1fccedadc13b71c1a7507f5b3d76ff82b10c481e9d2a53125b33e4c2f
Instruction ID: 5eaeae5893de67cee492bb79a24e8df66ddda7a09b6f4223a5882ddbca83035b
Opcode Fuzzy Hash: 1819b4c1fccedadc13b71c1a7507f5b3d76ff82b10c481e9d2a53125b33e4c2f
Instruction Fuzzy Hash: A4E0EAB5A043859F97518F6ABCC4957FBEBBAA5741304751FA800DA338E7B094418F24

Function 006C06C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 006C06E1

Strings

AdvApi32.dll, xrefs: 006C06C6
RegDeleteKeyExW, xrefs: 006C06D6

Memory Dump Source

Source File: 00000003.00000002.3918147075.0000000000681000.00000020.00000001.01000000.00000009.sdmp, Offset: 00680000, based on PE: true

Associated: 00000003.00000002.3918086349.0000000000680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918253295.00000000006CA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918344664.00000000006EA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006ED000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.00000000006F7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.3918430429.0000000000706000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_680000_setup.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: acee8dc94cb65adb0057fbcd985132a229fc67382de804a2f3e89c65b8afe613
Instruction ID: 22ec3fbd9cf11bc81695b8b1b67cae33a08fc0d722cb5be78266eabb2f807eb5
Opcode Fuzzy Hash: acee8dc94cb65adb0057fbcd985132a229fc67382de804a2f3e89c65b8afe613
Instruction Fuzzy Hash: CCE08CB06023A29BE7015F99AC88B633B93FB40B68F013228E4019E260C3B108488B94

Analysis Process: setup.exePID: 4788, Parent PID: 6136COMMON

Executed Functions

Function 071519E8 Relevance: 5.7, Strings: 4, Instructions: 704COMMON

Download Yara Rule

Strings

xb`q, xrefs: 07151A49
Te]q, xrefs: 07151D6B
paq, xrefs: 07152066
TJbq, xrefs: 07151A78

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$paq$xb`q
API String ID: 0-4160082283
Opcode ID: 4ea3f867dfc86c5f8195045e6724b5f57e306352a2dbdb0f10f3d90162c3fece
Instruction ID: 1aa4288f7fc4668cf9af7c0b84796c2e699b8a9edaf8c7d817e04c4558cd5ccf
Opcode Fuzzy Hash: 4ea3f867dfc86c5f8195045e6724b5f57e306352a2dbdb0f10f3d90162c3fece
Instruction Fuzzy Hash: 4C521875A10218DFDB1ACFA8C984E69BBB2FF49304F1581A8E519AB271CB31EC51DF50

Function 07150D90 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ba0efc42f28ef99f90a43b8cbf01bd123f6818428017bdcbd606f53e43bc81
Instruction ID: 842b683af2b8f7f4931776a6024ed62db4fcd1853a41f79aaae9cc1a8eefe09a
Opcode Fuzzy Hash: c3ba0efc42f28ef99f90a43b8cbf01bd123f6818428017bdcbd606f53e43bc81
Instruction Fuzzy Hash: 5F120B78A00219DFCB59DF28D898A99B7F6FF89300F1181A9D849A7365DB34ED81CF41

Function 0715C768 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a020381ccc3289bb866e5548ec33dcf500d9c009a87781d4c658e081c00e6f0c
Instruction ID: 2e39c4a5fbf5f36117f073994139801c065d4fcf709dd04f30bb6eccf7ccd78f
Opcode Fuzzy Hash: a020381ccc3289bb866e5548ec33dcf500d9c009a87781d4c658e081c00e6f0c
Instruction Fuzzy Hash: 12C16DB1E0422ACBCB19CF98C9806ADFBF1FB88305F148569D865EB245D774AD45CBE0

Function 07156A50 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b170b0df1ae00b2b89e86972ac9cec98191e8c38b1ddf11ca4c56199b601864d
Instruction ID: b24fa5a538b3ffb4a798644052e4396fb17c046ecb5a287bcadd808c3d0459d6
Opcode Fuzzy Hash: b170b0df1ae00b2b89e86972ac9cec98191e8c38b1ddf11ca4c56199b601864d
Instruction Fuzzy Hash: 8EB17078A10205CFD708DB68D459AAEBBB6FBC4700F51C139E8169B398DF789C46CB81

Function 07156A41 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feda0145b116e2ea26f1c465146735495cd069132d58469f0aad42ceebd98dde
Instruction ID: b52085f7827e69e2b1f84ea7c8071d8e5fb756dd4c3e40e1e939f8bb2e24c544
Opcode Fuzzy Hash: feda0145b116e2ea26f1c465146735495cd069132d58469f0aad42ceebd98dde
Instruction Fuzzy Hash: 27B19278614205CFD708DB68D469AAEBBB2FBC4700F55C139E8169B398DF789C46CB81

Function 0715F18A Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75568d5b49dc9974d810ff4ab7e793f6780d75a30b2dde0c90d197c6d01d46fe
Instruction ID: 96360cb430981585620e0e0732b88ed0224c6e041bfe735fa722404348fe2965
Opcode Fuzzy Hash: 75568d5b49dc9974d810ff4ab7e793f6780d75a30b2dde0c90d197c6d01d46fe
Instruction Fuzzy Hash: 8B8108B4A04306CFDB18CF68D45ABAE7BB6FF85304F118169E8129B2C5CB789947CB40

Function 07150040 Relevance: 3.3, Strings: 2, Instructions: 794COMMON

Download Yara Rule

Strings

2, xrefs: 07150887
$]q, xrefs: 07150385

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: 2$$]q
API String ID: 0-351713980
Opcode ID: 520d98ac67bf8df0891f278284ee542592ae9d9a4beff6182d1d89a79cc31fae
Instruction ID: 6de98fe105a56c627c232ae2ecd8ad32c5e77f3ef310de3bbf8b00a4dbea8a8c
Opcode Fuzzy Hash: 520d98ac67bf8df0891f278284ee542592ae9d9a4beff6182d1d89a79cc31fae
Instruction Fuzzy Hash: 1172EB78A00355CFDB58DF68D895AAE7BF2FB89700F1084A9E80A97394DB349D85CF50

Function 074E1C36 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

`Q]q, xrefs: 074E1D03
PH]q, xrefs: 074E1EA8

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID: PH]q$`Q]q
API String ID: 0-2790359648
Opcode ID: 799de397416579f0294013b99afb39060eb01a45530d2bc5d12dc92dbcb6931a
Instruction ID: 5445a4074a3e01976470bf84834791d971b91ae4be95807601f5da4202269fd3
Opcode Fuzzy Hash: 799de397416579f0294013b99afb39060eb01a45530d2bc5d12dc92dbcb6931a
Instruction Fuzzy Hash: F7617BB0A14258CFDB618F68D8997ADBBB9FB05715F1044DAD98AAB380CB341F81CF41

Function 038D2530 Relevance: 1.6, APIs: 1, Instructions: 124libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 038DAB5F

Memory Dump Source

Source File: 00000004.00000002.3922082512.00000000038D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38d0000_setup.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: baeceb6adad64b3844158025a57f6e915a01d0197e97ef1c50b884d7a7d82316
Instruction ID: 9d709be6ccc817204ed8cb7e9fb66f74361f3c716ebc532668ae70cc1425124f
Opcode Fuzzy Hash: baeceb6adad64b3844158025a57f6e915a01d0197e97ef1c50b884d7a7d82316
Instruction Fuzzy Hash: DF41BD71D142988FDB15CFA9C89079DBFF2EF45304F2880AAD854EB291D7789846CB81

Function 038D2554 Relevance: 1.6, APIs: 1, Instructions: 101libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 038DAB5F

Memory Dump Source

Source File: 00000004.00000002.3922082512.00000000038D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38d0000_setup.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dc20424b2dbab615b94487547ff3bc630bfe75c7d392b49e437ab405e92a78b2
Instruction ID: 635c0fae10e984f9098de51c361e7501ac01fa57bb94fb07ac5835e94959725c
Opcode Fuzzy Hash: dc20424b2dbab615b94487547ff3bc630bfe75c7d392b49e437ab405e92a78b2
Instruction Fuzzy Hash: 6C413870D102498FDB14CFE9C98579EBBF2EF48304F248069D815EB384D7B8A846CB91

Function 038DAF28 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 038DAF9C

Memory Dump Source

Source File: 00000004.00000002.3922082512.00000000038D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38d0000_setup.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 29ec65e3db29a66186a24e465b1ae486c5bd668b40f1e6af1eb70e22513d3960
Instruction ID: 07c6ae25b55807a47c461f7e787c0d3920275c2f336f7ccf5536cee5a854f2df
Opcode Fuzzy Hash: 29ec65e3db29a66186a24e465b1ae486c5bd668b40f1e6af1eb70e22513d3960
Instruction Fuzzy Hash: 232104B1D002098FDB14DFAAC844AEEFBF4FF48314F248429D519A7250CB79A945CFA1

Function 07156F10 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

Ddq, xrefs: 07156FA5

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: 411e629aa5c1a05a8af8424209102346be1618036df4213668646a609021780a
Instruction ID: 1591e8ad94d28b62f85e6f706ef7572fd8b8d867e2b48b28df543507bf2b7edd
Opcode Fuzzy Hash: 411e629aa5c1a05a8af8424209102346be1618036df4213668646a609021780a
Instruction Fuzzy Hash: 99A19E756002018FC718DF69E996A6DBBF6BF89310F1685A9E815DB3A1DF34EC01CB90

Function 0715D240 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

4c]q, xrefs: 0715D42E

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 7ba8b2cc1fc85015cd309188fb12e1d5be627253aab79af6c6e291f42ce3515b
Instruction ID: 47769ba120732027feaa63b095c8a3e80218c8b398e8f466f50d35151be0a67f
Opcode Fuzzy Hash: 7ba8b2cc1fc85015cd309188fb12e1d5be627253aab79af6c6e291f42ce3515b
Instruction Fuzzy Hash: B8617F787002068FE719DB69E05A76E7BF7FBC8310F118169E8059B7A5CB789C42CB91

Function 0715D250 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

4c]q, xrefs: 0715D42E

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 630bd6ed5c4dcc6e7279277a26c1d236587e2a486be15d17c0ee821a971cb6eb
Instruction ID: 2303e0ba8cd3874dc7c39e04fdb761fb646bc37c27d69f0d530a7ef1d5fd152b
Opcode Fuzzy Hash: 630bd6ed5c4dcc6e7279277a26c1d236587e2a486be15d17c0ee821a971cb6eb
Instruction Fuzzy Hash: 4C615078700305CFE719DB6DE05A76E76E7FBC8300F118169E905977A9CB789C428B91

Function 07156F02 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

Ddq, xrefs: 07156FA5

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: 704831f148479b720a58f6cba24c102435831e2871a7672a7e4c53358a0fa08a
Instruction ID: cfef46bbf5fb565a6fb41a15931ab4f2b16b4194e99d86bee6746824d4aaeaff
Opcode Fuzzy Hash: 704831f148479b720a58f6cba24c102435831e2871a7672a7e4c53358a0fa08a
Instruction Fuzzy Hash: 06616DB5610601CFC718DF29E59696DBBF2FF89310B1681A9E816DB3A1DB30EC01CB90

Function 0715DDB2 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

4']q, xrefs: 0715DE1E

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 415d47d1c77f398e9c8536865bece60100bb8df2791fb05c7938c53a9183b8a6
Instruction ID: 0855f114e465ea41e24b7e4f229e1b31bb1b1431b074c59f7a50a5f515dcb9e0
Opcode Fuzzy Hash: 415d47d1c77f398e9c8536865bece60100bb8df2791fb05c7938c53a9183b8a6
Instruction Fuzzy Hash: D751CEB4600302CFD71DDF28E085B6B7BB2EBC5300F018568D9959F399CB78A84ACB91

Function 0715233A Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

TJbq, xrefs: 0715236D

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: TJbq
API String ID: 0-1760495472
Opcode ID: 371a67b8a45168ac44c9cf25348139121af320437960849d033e9db35ac38162
Instruction ID: 26ffd94768b323f1abe967c0fb5c73296cd59e46c09573c10ed64bf4c9dbe4bc
Opcode Fuzzy Hash: 371a67b8a45168ac44c9cf25348139121af320437960849d033e9db35ac38162
Instruction Fuzzy Hash: 3D41C87A3042108FE719DA68E459B2F3BA7EBC9654F054079ED069B3C5CE38EC4643D2

Function 0715DDC0 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

4']q, xrefs: 0715DE1E

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: fb3a26e50a063fc708ddc3a5399a04418e2519ee649befe11db6d3febcba570c
Instruction ID: a01186b971f86b76865d1387f841ebf14c0300f010560397b6cad7622870d479
Opcode Fuzzy Hash: fb3a26e50a063fc708ddc3a5399a04418e2519ee649befe11db6d3febcba570c
Instruction Fuzzy Hash: 11518DB4600202CFD71CDF18E089B6F77A6EBC4300F118568D9559F799CB78A94ACB91

Function 038DB0F8 Relevance: 1.3, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 038DB15A

Memory Dump Source

Source File: 00000004.00000002.3922082512.00000000038D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38d0000_setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4b4433ffa1d1c37613853af08b05c7946e933de7144953e115f116cb80a1c972
Instruction ID: 1c5107318bafd3e72d3eabc08285908dfdd32d8978e88be0bcee353fcad6c2f7
Opcode Fuzzy Hash: 4b4433ffa1d1c37613853af08b05c7946e933de7144953e115f116cb80a1c972
Instruction Fuzzy Hash: 1E1146B1D002098FDB20DFAAC4457EEFBF4EF88324F248419C519A7340CB39A945CBA1

Function 074EAC18 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

4']q, xrefs: 074EAC1F

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 3c3643b24cbe25712d4edc59e318044d3cdaec73d766d97229e6458b6e3e3b50
Instruction ID: a75676971dcf2e8b1bd1b488f2e9e29f81d38904c7bc18e6fde307a3dc1281fa
Opcode Fuzzy Hash: 3c3643b24cbe25712d4edc59e318044d3cdaec73d766d97229e6458b6e3e3b50
Instruction Fuzzy Hash: 76E0C2353002119BC51EF76EF8108AE77DEEEC03217014939D09A8B660CF546C0E83E6

Function 0715E162 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feedfa18ab8fe86bf8a4445ec52021048e80a3548bccb77cba0c6494a28387db
Instruction ID: e3a6aa3a6566143afa26f09cbbecd267bcf15f36557a24f0949a381face69634
Opcode Fuzzy Hash: feedfa18ab8fe86bf8a4445ec52021048e80a3548bccb77cba0c6494a28387db
Instruction Fuzzy Hash: C5519174A04205CBE719CB58D49ABAE37E3F7C8304F1580A5E9169F7D8CB389D8ACB41

Function 0715CB58 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471043b2ec8e8c13b654c4ab84f32b0538d6acadb1529a00ee76f0e54bd26c47
Instruction ID: e45a924fdfcd1fe03a8b1bdcadcb302ade842e5bb758fdd7213776b9a25b9f00
Opcode Fuzzy Hash: 471043b2ec8e8c13b654c4ab84f32b0538d6acadb1529a00ee76f0e54bd26c47
Instruction Fuzzy Hash: 1F51B0B4610307CBD72DCE18D4957AA77F6EBC4350F158469E8269B2C4CB78AD82CBE1

Function 074ED610 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6accde9d642fc7ba8076bff46b7b9a55b37ac33cddad85e7958bf12b4d297eb7
Instruction ID: 97d4324fe6c585947914f025e45c9c0f0e8c121bcebcdb94c65265345c518cda
Opcode Fuzzy Hash: 6accde9d642fc7ba8076bff46b7b9a55b37ac33cddad85e7958bf12b4d297eb7
Instruction Fuzzy Hash: 09516DB1E05664CFDB14CBA4C940BEDB7B8AB85321F4505A6D819AF381C774EC06CF91

Function 0715E170 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f55b752b68950547d35ec673c30ff0c7b2adfffe5f01441ff30490115cea5e3
Instruction ID: 3d4c1c12c818b70d8de50680536afb1e79bff6f6ad8a8ae5e527e3399a4de089
Opcode Fuzzy Hash: 6f55b752b68950547d35ec673c30ff0c7b2adfffe5f01441ff30490115cea5e3
Instruction Fuzzy Hash: F4516E78A10205CBE718DB58D59ABAE37E3F7C8300F118064E9169F7D8CB389D8ACB51

Function 0715AD80 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e0e1bc5c03bea722a5cff3071a6b86ae17f4c4e9f3875aa09408fc554c075d
Instruction ID: 47f9ea691dfd08cd62788c9ebe70d1afe192341fc8edd9511ccf70b9d1c71dd2
Opcode Fuzzy Hash: 71e0e1bc5c03bea722a5cff3071a6b86ae17f4c4e9f3875aa09408fc554c075d
Instruction Fuzzy Hash: D74196F1794216CFDB1D5665D44063ABFA6EFC5202F05863ADC3B972C4EB34EC018691

Function 07159270 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24684ead0500022f2f6bf267806f2853229bba0457c6b69c75d1f6c593427746
Instruction ID: 9a6752dd8e0f63e60ce9dc69436ff101a7d77b975cf4dbfe17fb0518dc0d79b1
Opcode Fuzzy Hash: 24684ead0500022f2f6bf267806f2853229bba0457c6b69c75d1f6c593427746
Instruction Fuzzy Hash: 4F41EFB4758261CBD7AD5675C014A3E3ADA9BC6B50F0B4025EC768B2C0DB38EC01C783

Function 0715AD70 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba8f0d908e0d9157efcf881fbaa74bce5e388c9f3508c2eff23ed77a54dfcfc
Instruction ID: 2c5cf83df8d528a586f4f07df953dad4717897f729e95f16fa0e8e3b1594f601
Opcode Fuzzy Hash: cba8f0d908e0d9157efcf881fbaa74bce5e388c9f3508c2eff23ed77a54dfcfc
Instruction Fuzzy Hash: 2441EAF1698212CFDB1E5B24C48067A7FB5EF86202F06863ADC3B971C0E730EC018692

Function 07156418 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a270558de5edab40dd5c5a82ce84af91f5cd02c909b035d7e324078d9fced7ab
Instruction ID: 286b8118a674ed38c6c5d0db790fde3f80f5f2f5a98956e5bc66bffc40ecd6c7
Opcode Fuzzy Hash: a270558de5edab40dd5c5a82ce84af91f5cd02c909b035d7e324078d9fced7ab
Instruction Fuzzy Hash: 4D4139B0664345CFDB19CB24E4527EE7BB2EB8A720F4440B6E8119B2C8DB758D46CBC1

Function 07157952 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d574d568808e1a44d6dd1d1cd75cc08881712558a4a2d9bc62a5ed62ba0ba0
Instruction ID: bda0ae07aeec10d29669f786038c577d9af0e5d2c1b1653d2e4a4c3190c54bde
Opcode Fuzzy Hash: d5d574d568808e1a44d6dd1d1cd75cc08881712558a4a2d9bc62a5ed62ba0ba0
Instruction Fuzzy Hash: D0414BB4E14215CFEB29DB64C846BAEB7B2AB44300F1540A9DD69A73C0DB349D81CF51

Function 07154E28 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3a994781b8179165c729fd278fef36afe61df53890eca3f9436857b1fa1618
Instruction ID: cf5a4d9a81d4dfc301803c4f1bea22e1a711bd1c300e33c82867af5bce11b715
Opcode Fuzzy Hash: 7a3a994781b8179165c729fd278fef36afe61df53890eca3f9436857b1fa1618
Instruction Fuzzy Hash: 07312BB53042A1CFD71E5B79E41862EBBE6EFC5251B46047ACD26E7280DB38EC468351

Function 07159260 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f89ddb9bc1fcbb33e467ad2a1e408b27706479e4c38c74ef982c69b4fe6788
Instruction ID: 66ba0dd56344992e7430e06563f003488126dd82fefe83f0003127388cbb2802
Opcode Fuzzy Hash: a2f89ddb9bc1fcbb33e467ad2a1e408b27706479e4c38c74ef982c69b4fe6788
Instruction Fuzzy Hash: C731D4B57182A1CBC7AE5A31C454A7E7BA6ABC6751F0B4066EC768B2C0D734ED01C743

Function 07152ACE Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddbe61a4c0cd86c588f139b94ba32c05f5585b30d5b705fa7fabe2866f402b4
Instruction ID: ed83d9da8633fe5389eac4673354c74fb273cd9a69a1f17e8ee9af62dc256c7e
Opcode Fuzzy Hash: 8ddbe61a4c0cd86c588f139b94ba32c05f5585b30d5b705fa7fabe2866f402b4
Instruction Fuzzy Hash: D9416DB7914212CBDB19CB98E44A62E77E1FB88310F568424DD26FB284DF38EC058B91

Function 0715DE48 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade39a5df1ba951299d8dc36710b373b7932f9553d33058a0907f323992d6269
Instruction ID: 6415e4b7c426e3cbb1318b8e528bb206111bdae98aaf5e5baf8ea6bbf44a2dba
Opcode Fuzzy Hash: ade39a5df1ba951299d8dc36710b373b7932f9553d33058a0907f323992d6269
Instruction Fuzzy Hash: C8318DB4700202CFD71CDB18E086B6E77A2EBD4300F118565E955AB799CB38AC86CB91

Function 0715D950 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215e202c0bf361caf9ece4d8308e367c313759ef76c352059ec8b4c58e90a9e3
Instruction ID: 1109866b0044f6df61a57b3e7c1a95a62d1b9d9b9e583f07399bd6c9444128dd
Opcode Fuzzy Hash: 215e202c0bf361caf9ece4d8308e367c313759ef76c352059ec8b4c58e90a9e3
Instruction Fuzzy Hash: 42313AB5E0030ADFCB04DBA9E8467EEBBB1FF49300F518526E555A7284D7B81546CF81

Function 07150006 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daed3d777bc9e4e4a06ab1f39c9103d6c30ecde77f8ef02ce87ff49233cb3c0e
Instruction ID: 3a8df4847e9a04de6de90c90f7c19f7c199de5fdca89e0bca54c46386f2413aa
Opcode Fuzzy Hash: daed3d777bc9e4e4a06ab1f39c9103d6c30ecde77f8ef02ce87ff49233cb3c0e
Instruction Fuzzy Hash: 1D3106B49093468FC716CF68D496A9E7FB2FF89304F1540A6E445CB292DB389D45CB81

Function 07154E17 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ac8ec5411e220d146c9c2e188710ac22685016b4fac1f8c331d26e929eb060
Instruction ID: 48171b2ea6496c9c1a047173b55ec3a35cd267ea7873d90d4351f62e4c3a92e3
Opcode Fuzzy Hash: 89ac8ec5411e220d146c9c2e188710ac22685016b4fac1f8c331d26e929eb060
Instruction Fuzzy Hash: 8B213AB13042D2CFD71E8B39E44456AFBB1EFC9221B1A017ADC65D72C1C7389C828741

Function 0715D960 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ee7d9aa753cea3e105cba3152168dafd6844c40ce336770ed9926c1e52d6b2
Instruction ID: 7ac1eabd77f33175f8c9b5e94caeee7c30e8665393696bf7d7e1a87c7ad3ffb6
Opcode Fuzzy Hash: 70ee7d9aa753cea3e105cba3152168dafd6844c40ce336770ed9926c1e52d6b2
Instruction Fuzzy Hash: FE3149B4E0030ADBDB08DFA9E8467AEBBB1FF89300F418525E555A7284D7B825428F81

Function 0715DFE0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616d5f341590cef873558a42e6baa648b6dcf82d30afd1dfc041eef7d1b17cc5
Instruction ID: c2066055cb3b7fa33ee4ed37646f10eed42ef5550fc959e5c81c01506885171c
Opcode Fuzzy Hash: 616d5f341590cef873558a42e6baa648b6dcf82d30afd1dfc041eef7d1b17cc5
Instruction Fuzzy Hash: 0621CFB4F04206CFCB08DB68E4567AE7BA6FB85311F504165E8218F3C5C7389A478B92

Function 0715E420 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf79f3f2bbfb13e00c63ece54b620b6be131ee50d4198066f79827efcc63b6e
Instruction ID: 14c7fb60951e70c124cb59851acb6906b3dc438b96dbffa6ae07b7ba634fdd7f
Opcode Fuzzy Hash: aaf79f3f2bbfb13e00c63ece54b620b6be131ee50d4198066f79827efcc63b6e
Instruction Fuzzy Hash: 101127796043449FC30AD778E4169AF7FE6AFC6210F1181E6E901CF291DF399D468392

Function 07152DA0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef42bdff2f573444bf237e269fd9d2da86c32b388bb1a3b63d68f2727c69e91
Instruction ID: 5d75ee892bab289519c60abc0e1e2036d50e2e5444e489a3ee08740173ae6b14
Opcode Fuzzy Hash: bef42bdff2f573444bf237e269fd9d2da86c32b388bb1a3b63d68f2727c69e91
Instruction Fuzzy Hash: 5A01DF7B5691A4CACB175534FC980D83F30FB92064BC80197D4E2CF9C3D768A14B86C6

Function 0715E9B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a837e39fa21d74d2832c38756b76ceb93b089526cc9e5a5ae597aa3330da4a78
Instruction ID: 3d14ce369aed0cbd9ab7cf8e28009d51d563ab93240d98b712e0878de8a2fae3
Opcode Fuzzy Hash: a837e39fa21d74d2832c38756b76ceb93b089526cc9e5a5ae597aa3330da4a78
Instruction Fuzzy Hash: 2401D1A2908388AFCB06DBA4D4414D97FB48F4721070541DBD498CF283DA258B4797A2

Function 07153B93 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad0fa2a88504da1f7ab67b84f652625284c3b57c741b8a26d63312dc33cfcf7
Instruction ID: 5589c430b3d744b7e0f19b7335bcb22f5e39599551d5c04f7d9852c69f3cd97e
Opcode Fuzzy Hash: dad0fa2a88504da1f7ab67b84f652625284c3b57c741b8a26d63312dc33cfcf7
Instruction Fuzzy Hash: 4CF0F9B6E082208BCB2ACF61980455EBF69DB85654B0580B7DC39DB181DB344A458781

Function 0715EFD2 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e308c56a7e120d12e2108564b664a005b58b193951d8c0ff922edfd0fc57713f
Instruction ID: ce9980ceeeac79ac71dfec39a32d81cc7c1260fe293274f16ba2e68142f8cf5a
Opcode Fuzzy Hash: e308c56a7e120d12e2108564b664a005b58b193951d8c0ff922edfd0fc57713f
Instruction Fuzzy Hash: 56F0C83510C7D59FD3178768E8554E6BF7ADF8612070C80EBE8858BA93DA19AC53C3D1

Function 0715E410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09cfbf84eaf33eae0fbfa13704b4d2dc0f54a1fb0e5614fd330f491795250260
Instruction ID: 47dd168b6d64902de75426ccff661b12eb3bc8dac44e6590951d611533e56619
Opcode Fuzzy Hash: 09cfbf84eaf33eae0fbfa13704b4d2dc0f54a1fb0e5614fd330f491795250260
Instruction Fuzzy Hash: BCF0A4797002008FD306DB68E05A6AE7793ABC4654F15806AE905CF3D4CE389C438781

Function 0715E41F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8d9d6546e3af913a2d3197a97b8007577fe1ede33449d8fe4f53fb9fa39e6f
Instruction ID: b2f17b535803c7e0b32792ddc15130d6836680e46ed2f6c38ac5228a1b8fd12f
Opcode Fuzzy Hash: 5f8d9d6546e3af913a2d3197a97b8007577fe1ede33449d8fe4f53fb9fa39e6f
Instruction Fuzzy Hash: B2F0A4393002009BC219E768E05AABF77D3EBC9654F518029E9058F394CE389C438391

Function 07152DEA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbb4be09b440c0bfb271119bf78bb83489d2e3971e7a19fa646e2598d56cc45
Instruction ID: 9e1f3a66be913211ccfd106bef3dabb582a733a224e976e1a5f66e432d38161b
Opcode Fuzzy Hash: 1bbb4be09b440c0bfb271119bf78bb83489d2e3971e7a19fa646e2598d56cc45
Instruction Fuzzy Hash: D1E092774981E48FC7034A20EC985C83F30E9431693D80297D8D5CF5C3DB99554B86D1

Function 07153BA0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e3d428705b577cc2b983e800d0c8115e881c679b69b48999fe1b85cfed3b9f
Instruction ID: 7963fb66141a28f9ba7c3aca09b3d629b3ac6bf195ba46e4ada18a95ec80bd2b
Opcode Fuzzy Hash: f4e3d428705b577cc2b983e800d0c8115e881c679b69b48999fe1b85cfed3b9f
Instruction Fuzzy Hash: 9AF0E976E08120D7CB2DDF66940465FBBADDBC4655F068075DC3DD7180DB384A414B81

Function 07157250 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae7fed896133c59bb83183d467d3e3e79ed2a0d7ed99111d5b353aeff1e6417
Instruction ID: 3cc93dcf8b585f59202b7fad62af334e7ffbcc7c2fb55e6fde48006d711fcbb7
Opcode Fuzzy Hash: aae7fed896133c59bb83183d467d3e3e79ed2a0d7ed99111d5b353aeff1e6417
Instruction Fuzzy Hash: 27F027253453181AD30C9AAD3C51B6B9A9EAFC0610F2584AF9049CF2A6CC358C0543D0

Function 0715AFA1 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf73f1c101fb4b6db4734df52a510151ed5a756b69fc9e60e3bfe60d9b91f9d3
Instruction ID: afa2d17575c38e6ac9fdfcceebfea26462b756e2e1f52c80e00b737ad4b2398d
Opcode Fuzzy Hash: bf73f1c101fb4b6db4734df52a510151ed5a756b69fc9e60e3bfe60d9b91f9d3
Instruction Fuzzy Hash: F1F030B105D3C08FC3079B7898A04487FB4AE5760471A00C7D5D4CF2B3D215DC29C762

Function 074EFA00 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354b0d3f7c9279cdf3670c9be05961576c5454221bc96375040ad64522064983
Instruction ID: a3d1ea062fbec39689ef72f80961924c3a2eeac1eb3053c7d1c47eee2dcc2657
Opcode Fuzzy Hash: 354b0d3f7c9279cdf3670c9be05961576c5454221bc96375040ad64522064983
Instruction Fuzzy Hash: D0E09A653403186BD30CAAAF2854B2BA9DEEBC5A60F24883EA509CB3A5CC658C0143E4

Function 07157260 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d0b972dc640a940a037ef5ceab67f59025cbce6cf0ef5bb21a3e5c7b4302c8
Instruction ID: 34cd426d3343b8ae00e487c69a48bc5ec325815ae2d3d5f41fb353eb1cccfad5
Opcode Fuzzy Hash: 99d0b972dc640a940a037ef5ceab67f59025cbce6cf0ef5bb21a3e5c7b4302c8
Instruction Fuzzy Hash: 8DE092253003182BD31CAAAF2854B2B999EEBC5A50F14846EA509CB3A5CC658C0143E4

Function 0715EB10 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d8c6fbf7fcea715f8b8824c243b0c61b501f8a9ed68c5ad665221ea32fbc25
Instruction ID: c812a1526133a5197c9f2264c353401a7016597bdd2a71563cec99845d951bfb
Opcode Fuzzy Hash: 31d8c6fbf7fcea715f8b8824c243b0c61b501f8a9ed68c5ad665221ea32fbc25
Instruction Fuzzy Hash: EFE0EDF1C08389EFD70ADBA498019C97FB9DF02200B1002E7D9419F6A0EA366B0487A7

Function 0715D85F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf30e6296bb74034fb9942bf36afe0363930a8276e96f2c8358bf1d2c55085b
Instruction ID: 5636cd89ae3c8f37607a3b72d8bce9b82946a4c786e37f0df9e07f57d4348c4c
Opcode Fuzzy Hash: 7cf30e6296bb74034fb9942bf36afe0363930a8276e96f2c8358bf1d2c55085b
Instruction Fuzzy Hash: 50F03074D00209DFCB04EFA8D406AEDBBB1AF48300F0080AAD809DB342D3318951CFC1

Function 07156310 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d52592b6531fe6727d2dedbcdbf1600737a744a10e684b3dd8ed89579c8837
Instruction ID: 0151bdbfc99bcfd5d565737a86c2fb2ab92dce0e71eb4e9e4eb137f9139aef98
Opcode Fuzzy Hash: 42d52592b6531fe6727d2dedbcdbf1600737a744a10e684b3dd8ed89579c8837
Instruction Fuzzy Hash: 30F0BB74609245CFD359C718D45A7AE3772E7C0705F8480B4E91E4B3C6C7795983C6C2

Function 07156320 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5c4711eb530e369789e524052b399963bb66ed357e29e77640c02806327ad9
Instruction ID: 39686e5460213cea8e96edb997de3af45f59850066fa6f4e8876d495fa5ee7ac
Opcode Fuzzy Hash: bd5c4711eb530e369789e524052b399963bb66ed357e29e77640c02806327ad9
Instruction Fuzzy Hash: 69F030B8205205CFD3588B18E05ABAE36A3EBC4705F858074E90E4A7C5CB79A883C681

Function 074E8B20 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7091986cdb546450f0228ec7362322222a16020a0f5e9fe8d10a89e99384192
Instruction ID: 34dbbadc25c9619294e07195833b4b5776c9d45016557ee770782345e1af97ea
Opcode Fuzzy Hash: f7091986cdb546450f0228ec7362322222a16020a0f5e9fe8d10a89e99384192
Instruction Fuzzy Hash: F2E0D8708042589BEF101A65C80E7EFBB7CEB01361F414475D98573280D7797D44CAA2

Function 07151EAE Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f017ce34c695ffc4c60a2c9b2b9b6e710752194bfebc07b9acb334c346e294
Instruction ID: bba4a5af49ed906bfcc63baa567a1c435527b71cbaa5cbf5288f4ecd18bb6299
Opcode Fuzzy Hash: 00f017ce34c695ffc4c60a2c9b2b9b6e710752194bfebc07b9acb334c346e294
Instruction Fuzzy Hash: 08F0E5BAA04218DFCB18CF84D984BADF7B2FB95300F5180A6DA15AB6A5D3309A418F51

Function 0715DD48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b57727b15763b75ee0ab8a80892839d4d93d53f1f8beab67a7af4164b3fa76d
Instruction ID: af2646c2043b895c33039685ec01cf9ac9196f8d449120db429af67e7b05fdad
Opcode Fuzzy Hash: 3b57727b15763b75ee0ab8a80892839d4d93d53f1f8beab67a7af4164b3fa76d
Instruction Fuzzy Hash: 19E0D8316083819BC316075CA415AA93FE99B82210F0640A6F148C71D2CB7C8856C354

Function 07151998 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954392d501f2af801b184b337a999f50e68684569cf45301b96b76e553974bf8
Instruction ID: aba5402adca092c23fd35e445830956256599c4a93d10319ecde23ca7736df34
Opcode Fuzzy Hash: 954392d501f2af801b184b337a999f50e68684569cf45301b96b76e553974bf8
Instruction Fuzzy Hash: 4DE04F759492089FDB02DFB0A8545897FB8EF4620470149F6D808DB152EA394E199792

Function 071525A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5210c47093f1844472af12b3e697abf77a2164ff6a3fa350c4bfd0564cacbf0
Instruction ID: bdc27195a14c088eaa1ce5198afbed7a399991ae3cf8c51fc75c32f209004a58
Opcode Fuzzy Hash: c5210c47093f1844472af12b3e697abf77a2164ff6a3fa350c4bfd0564cacbf0
Instruction Fuzzy Hash: E1E08CB5989208EFDB02DFF8AA405DD7BA69A4120930045FAA804DB262E9359A099392

Function 0715EF62 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0a0b8c8e5a5e61e65d288a7443e819568b0cb2b9802cd9f825e741fbae99ca
Instruction ID: 1a9afc9274551ae6aac837206133a8e7839d473fae961a2cab53ba03958ed754
Opcode Fuzzy Hash: ee0a0b8c8e5a5e61e65d288a7443e819568b0cb2b9802cd9f825e741fbae99ca
Instruction Fuzzy Hash: F2E0C2302083865FC305C728CC51861BFF4DF8621472880EED484CB653EA31A822C390

Function 0715CDF1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114083afec3ecf90feffce0788ebb62a41025c1c9bc9d38ffbd947a682bd4463
Instruction ID: 8f3d485e175fb8c41e122a093efc22ffc1072c37de280e67c7f79ce3fbc13df9
Opcode Fuzzy Hash: 114083afec3ecf90feffce0788ebb62a41025c1c9bc9d38ffbd947a682bd4463
Instruction Fuzzy Hash: 26E012352092845FC745C768D8914E1BF75DF8A514328C09AE888CB653DA21AD17C761

Function 0715EA82 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6657ad205f09f9d112255a960f17c519b2ade329527b2c0171960be6bda6ee
Instruction ID: f114c298fcf0917569c6556dd6d110f42fc2a8441186f619fe9aa4dceb56e44b
Opcode Fuzzy Hash: ae6657ad205f09f9d112255a960f17c519b2ade329527b2c0171960be6bda6ee
Instruction Fuzzy Hash: 6BE0123120C3445FC70ACB68D851491BBB4DF59510314C09AD949CB753EA31EC22C795

Function 0715EAE8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709b169727bbc8438c3af49c11dabe8513c80e233948d36dbef6ccd635539a49
Instruction ID: 396a43957c1a75aca3e85fa6ffea558cc95e7c39a2a221232d46634572ddba21
Opcode Fuzzy Hash: 709b169727bbc8438c3af49c11dabe8513c80e233948d36dbef6ccd635539a49
Instruction Fuzzy Hash: B0E017313586816FC306CB28C8A08A1FF70EF9E15032884AAE488CB352E6229D57C311

Function 074E4FA4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0cc4509a1de9cb9b8ea0f59a7337667b5018763ec9ec6767cc02dde2688259
Instruction ID: 88825be3bf1ca64109bb63c2d9d553e1229d44d78ddd8ac8db0f11d3aa4b30a8
Opcode Fuzzy Hash: 4a0cc4509a1de9cb9b8ea0f59a7337667b5018763ec9ec6767cc02dde2688259
Instruction Fuzzy Hash: 62E02C34C102298BEB16CB30C8402C8FBF6EF48610F8685AAC84A12002C6340ACBCF80

Function 074E05A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5920002a2e1ecbeae9787f46da5d888cda1cbfc80d2e983faab51095fae36bde
Instruction ID: 80ba91cbe4b7f430d1588f1f5271f043a33b20092938f316bb9434086347cbda
Opcode Fuzzy Hash: 5920002a2e1ecbeae9787f46da5d888cda1cbfc80d2e983faab51095fae36bde
Instruction Fuzzy Hash: E6D0C9F341A3C8DFD3032B74B85E0C43FB5AA1A5723490492E085C95629B191D8287A7

Function 0715EA18 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82add601c461285da57f6832aeeaf66a33da9a45114f5acba56d8adf86d1754c
Instruction ID: b7fdca41cc547246f164f63453f2173a677218ad4d8670b91e1965fa28c881dc
Opcode Fuzzy Hash: 82add601c461285da57f6832aeeaf66a33da9a45114f5acba56d8adf86d1754c
Instruction Fuzzy Hash: 64D0A7B22543905FC70ACF54D8508E67B71AF95210315C18BE809DF293D632DF07C795

Function 0715CE20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcf75072f65080673201318274c3fb1e85cecb13c1ff9063c28d492648c9018
Instruction ID: 3d63887a6d8fbb530fd0dcf404433caec47cbde2116509e865587a0ae1a026ba
Opcode Fuzzy Hash: 2dcf75072f65080673201318274c3fb1e85cecb13c1ff9063c28d492648c9018
Instruction Fuzzy Hash: F4D0122114E6D30FC38303B0A9AB0D0BF30CC0706032C00E2C1CA8B883EBAA082383A2

Function 071525B0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c209e63bc754ad5d2796cba56dba6c5d041333fc5d7c7a0e1b6fb9a2f37a55f2
Instruction ID: 4f58006f34927ff4bc57430bd334109780d9c95c40dece9d34f5452e6b4c6d88
Opcode Fuzzy Hash: c209e63bc754ad5d2796cba56dba6c5d041333fc5d7c7a0e1b6fb9a2f37a55f2
Instruction Fuzzy Hash: 72D0C77594530CFF8B01EFF4D90199E77EDDF4510471045E59504E7210ED759E109792

Function 07156428 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74db792b83cfc3c9e40e29dce7c554d72d09f27021d1d2883978610bf25c923b
Instruction ID: 1205d2db758be8aea70a603b9e5a2a03f61ab50f1e465b348517cbf2a04b6382
Opcode Fuzzy Hash: 74db792b83cfc3c9e40e29dce7c554d72d09f27021d1d2883978610bf25c923b
Instruction Fuzzy Hash: 9AD0C97594130CFF8B01EFF4D90199EBBEEDF45211B1046E69904EB210EE769E14A792

Function 0715EB20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7736329ae7560ba1532021de1bd6a603dc5da06ac724c900cfc0b38d04e512
Instruction ID: 5e027b7f3f9a7f21a9158defef3c8710586898dc3678bb93f3feb30fc3ab8709
Opcode Fuzzy Hash: ae7736329ae7560ba1532021de1bd6a603dc5da06ac724c900cfc0b38d04e512
Instruction Fuzzy Hash: 98D0A7B594020CFF8B00EFF4D90158E7BEDDF4510070046E58504E7210ED325E009793

Function 071519A8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294ee22e7418af28dd47956241571ac1adc9b18767a1394070e8c88247fced20
Instruction ID: ba13fa94021e7409f76a215ad32b5db8d2fbf6b21475d3444f901296e6db40da
Opcode Fuzzy Hash: 294ee22e7418af28dd47956241571ac1adc9b18767a1394070e8c88247fced20
Instruction Fuzzy Hash: B7D05E7984420CAB8B00DFE4D90094EBBF9EF4920471045E6D805D7210E9359E009792

Function 0715BEF0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ab965423833fb8b2ba36c57ed73771eabecdecb45fddd3ff8564c97bebd34b
Instruction ID: 7659535d3d8b0a7ce2fe7e944d0f5524858d1ba74a1f18163ea0db6bf9ac07d2
Opcode Fuzzy Hash: 95ab965423833fb8b2ba36c57ed73771eabecdecb45fddd3ff8564c97bebd34b
Instruction Fuzzy Hash: 26D0C93410D6C18FC347877998A4894BF70AE1B12531E81DAE1C8CBA63D3254925CB21

Function 071525E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c96fc24ab4614558ca46a82d0a53b3036d4ac3123ff58ff4d02c35f96436a65
Instruction ID: 323202df5b5e84c13e376c881e8e058a78062f6d793c663f28e3e7027dff6569
Opcode Fuzzy Hash: 1c96fc24ab4614558ca46a82d0a53b3036d4ac3123ff58ff4d02c35f96436a65
Instruction Fuzzy Hash: 58D01230A8D1591FC742D654A8F1594BB20EA46118704C0EEE84CCF2D3DB2AD907C2D6

Function 0715C1B1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e628b86120345b0474de42e953c8e9f4f3cfdbf824204cb30671e4d08b32816
Instruction ID: 289a12f180fafc22dd5a9b9303424e4910aa277a19371dc06ca19eb36a07b318
Opcode Fuzzy Hash: 3e628b86120345b0474de42e953c8e9f4f3cfdbf824204cb30671e4d08b32816
Instruction Fuzzy Hash: 03C0023208E3E18EE70B53B498A10907F714C5727737D05EBC4C8C95A3862A44A68311

Function 074EF678 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f2f650753b6aad284fa7f6cd223be25fcdad7f1eee172a0c3e8fb36cf29f1c
Instruction ID: 6c44bdc6a7f5baadecb3eba7b767ea89efe00c675b237b4fe588623973a8b54a
Opcode Fuzzy Hash: a6f2f650753b6aad284fa7f6cd223be25fcdad7f1eee172a0c3e8fb36cf29f1c
Instruction Fuzzy Hash: 4BC08C3620412C63C609228CB0091EA728DE7C5522F1000AAE10D87641CDA64C0003D5

Function 074EA9A0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd354fcfbbfdb47aae55b2583642759adc3099172d0f7819460d4970a046237
Instruction ID: 8093a7572192e7812dc6d90bb1ff260996a9f2b80fcb4aeaee125625388e73b4
Opcode Fuzzy Hash: cbd354fcfbbfdb47aae55b2583642759adc3099172d0f7819460d4970a046237
Instruction Fuzzy Hash: 29C0123220022CFB8F021E84E804CEA7B2AEB88271B008016FA184221086328920ABD5

Function 07156EE2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c1edf82be8afa9339799aa4b93af7bd045afc34bcd781a2d44016f3f745c3d
Instruction ID: 20a802500ea8d77270ef79f56c42924024361aa8e629a08d30ed1ea60b9733ec
Opcode Fuzzy Hash: 54c1edf82be8afa9339799aa4b93af7bd045afc34bcd781a2d44016f3f745c3d
Instruction Fuzzy Hash: AFC08C3A00E3C15FC3031B60B4A40D0FF30BD8B22071C10D2E1DC87113DA284A26C3A3

Function 0715CDB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f087cc2f18193d1cb112e436ec9339b5713168c03ed6d984d559ad92b6af35
Instruction ID: 9efabad609947e8f6701b5031efd27a11dbce9bab47c9e895a24a6ed3b3d8585
Opcode Fuzzy Hash: d6f087cc2f18193d1cb112e436ec9339b5713168c03ed6d984d559ad92b6af35
Instruction Fuzzy Hash: 70C04C6904E2C39ED74307B454654D07F319D8B52532D40C3E0C485853A35428278372

Function 0715EA27 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d87a308153844f636350f865ec12a6f63f81f1456fc032bc803e2f16e24a21
Instruction ID: 39466aa8313c61e414180fd1c115b7182d5dba11e29d71d1262273acefb27b8b
Opcode Fuzzy Hash: c5d87a308153844f636350f865ec12a6f63f81f1456fc032bc803e2f16e24a21
Instruction Fuzzy Hash: 0EC08C343002086F8304CA9CD842C62F7E9DBC8610310C02EB80CC7701EE32FC03C6A0

Function 0715FAFF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d87a308153844f636350f865ec12a6f63f81f1456fc032bc803e2f16e24a21
Instruction ID: 39466aa8313c61e414180fd1c115b7182d5dba11e29d71d1262273acefb27b8b
Opcode Fuzzy Hash: c5d87a308153844f636350f865ec12a6f63f81f1456fc032bc803e2f16e24a21
Instruction Fuzzy Hash: 0EC08C343002086F8304CA9CD842C62F7E9DBC8610310C02EB80CC7701EE32FC03C6A0

Function 0715E13F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53720e238a2b90240cc19433bef05e460035844801679f7184a981ecf238ce57
Instruction ID: f3a5e49e60d8ac8bea5fcac705963cc26c7ae06afd52d460838dd54faad37b20
Opcode Fuzzy Hash: 53720e238a2b90240cc19433bef05e460035844801679f7184a981ecf238ce57
Instruction Fuzzy Hash: D8C02B3230022457C71022B8700A0DE7BCCE64A1213018223F40DC3F40CE7D8C0003D5

Function 0715D92F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c85542e366d3b3a1e0537bd58f1b2d8bcc8ffd1a5ec96b4b31c3a68be57003
Instruction ID: 9cd16929978ca1ffb8283fe4b4651bbd0681e8e098d82e35e42a554a3eb47184
Opcode Fuzzy Hash: 89c85542e366d3b3a1e0537bd58f1b2d8bcc8ffd1a5ec96b4b31c3a68be57003
Instruction Fuzzy Hash: BBC0126240D3C55FC30A5B10D4456817F78DB57104B4601C7C04A4E967D629561BC381

Function 0715E9BF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d87a308153844f636350f865ec12a6f63f81f1456fc032bc803e2f16e24a21
Instruction ID: 39466aa8313c61e414180fd1c115b7182d5dba11e29d71d1262273acefb27b8b
Opcode Fuzzy Hash: c5d87a308153844f636350f865ec12a6f63f81f1456fc032bc803e2f16e24a21
Instruction Fuzzy Hash: 0EC08C343002086F8304CA9CD842C62F7E9DBC8610310C02EB80CC7701EE32FC03C6A0

Function 074E30E5 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff5ae2422a5a9998af3461fe63ac51f564da05f2067ffefb65c9c44967ad434
Instruction ID: d2307a30296ab55ff6c3673f20783fb0b9cf246288a8172c193d2a33683d1b49
Opcode Fuzzy Hash: aff5ae2422a5a9998af3461fe63ac51f564da05f2067ffefb65c9c44967ad434
Instruction Fuzzy Hash: D9D017F0A051948FCB15CFB8D85926C7BF9EB88202F0041A6984BD3280DB384E41CF00

Function 0715CE00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0715534F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ea77f69d8f135b8eeb90ec91fe30d9985c65d4a62f3fc935e24499933eb425
Instruction ID: 78fa7e8658c2480b3b5c03555b23180d5ada3a01afcaa5eca7185affcd33adf8
Opcode Fuzzy Hash: c1ea77f69d8f135b8eeb90ec91fe30d9985c65d4a62f3fc935e24499933eb425
Instruction Fuzzy Hash: EFB0927B76D524CFA60C5684F4A44ADB733F6C0136B200027EA2A81280DB2619128654

Function 074EA910 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df29431b0e75df59fb9d82fefd9855189ab42b2217a5557f6de6eb109a701f94
Instruction ID: acca5ed894aa250990723ee527a8bb1fd2382ad157b43449cccf6ee63172a9c1
Opcode Fuzzy Hash: df29431b0e75df59fb9d82fefd9855189ab42b2217a5557f6de6eb109a701f94
Instruction Fuzzy Hash: EDC04C39140108EFCB419F55D844C457FA9FF19760741C051F9494B631C732E960DB50

Function 074EA410 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1594d93a6f0a8cdfa8fd9289cd544348cfe5f20df95678c334e2805c3ed5c716
Instruction ID: 6d9bc2b1490787b83bf9d7a9398c67dcaf0cc526b475210423a49d7bc3471a98
Opcode Fuzzy Hash: 1594d93a6f0a8cdfa8fd9289cd544348cfe5f20df95678c334e2805c3ed5c716
Instruction Fuzzy Hash: F4C04C36140108EFCB419F55E944C457F79FF197607118051F9484B231C732E924DB51

Function 0715EB5F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6f106ddc62cc1420e67730d15f3413fd7829e3a20371f8712a97cd257ff577
Instruction ID: 508368cf0161b12142579153fa980a2512fc59b99295b11402a968c6267dfd81
Opcode Fuzzy Hash: 7e6f106ddc62cc1420e67730d15f3413fd7829e3a20371f8712a97cd257ff577
Instruction Fuzzy Hash: F9B092342081085B8244D6A8E842864B7999A84618354C0AEE80C8BA02CE33E80385D5

Function 074EFAA0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 074E49C2 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03d779c53f5c0637397c79d2056946a64a105c3302d1db16a49a59816e4ebf4
Instruction ID: c0fffafd2d1e9a918d263cb95a8f42d67312e78c5b784d72576583355c4e5fbc
Opcode Fuzzy Hash: c03d779c53f5c0637397c79d2056946a64a105c3302d1db16a49a59816e4ebf4
Instruction Fuzzy Hash: BCC04078A452548BCB545F7CD01D15C7A61A745211F5144769D5BC3340DD7C9D804F04

Function 074E500A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a59f82624cddbceb7cec03c8234868c3566fbdbda7efc75a46acb19bb89958
Instruction ID: 6e6223e383156e9ff301b3d038aaac7de50a565123f81b42c2ddf91f9d526bec
Opcode Fuzzy Hash: 92a59f82624cddbceb7cec03c8234868c3566fbdbda7efc75a46acb19bb89958
Instruction Fuzzy Hash: 9EC02B7CD10002C3DF004739A01E1AA23DA8788116F108143584302310CD348C4387C1

Function 071525F0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 074EEF40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction ID: 20159973dc6c4478fa717a34ac84a2881d4813b9dc5cbab7339b5de6a68ee492
Opcode Fuzzy Hash: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction Fuzzy Hash: 0DB01231250208CFC300DB6CE444C0033FCAF4DA1431000D0F10C8B331C721FC008A40

Function 074EEF60 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba36aef03bc27f84ab667d144efac4fccdcd93af6e34ac239b6cc8976010b3de
Instruction ID: a086de6630c9c25d0d1ef151d61145ab0e9105ca671659dc64f504c3d7f1862d
Opcode Fuzzy Hash: ba36aef03bc27f84ab667d144efac4fccdcd93af6e34ac239b6cc8976010b3de
Instruction Fuzzy Hash: DBB092301402088FC300DA58D445C5077A8AB08A0430500D0E2088B232D622F8008A40

Function 074EAB80 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9daf118bfbcc3bf9e3a36b33321736fd5490af0d73cb682b29b312aa5d5cce5
Instruction ID: 0d3249c45e54e982a1c7318e279da309283474fafde044080f2c3a1230d30425
Opcode Fuzzy Hash: b9daf118bfbcc3bf9e3a36b33321736fd5490af0d73cb682b29b312aa5d5cce5
Instruction Fuzzy Hash: 42B092311402088F82009B58E548C0137A8AB08A143010090E1088B232C621FC008A51

Function 074EAAF0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction ID: 7de4840db72a739a7296ecabbd3d178890c8b70a70b6a7fce96b4b1d731f9c0f
Opcode Fuzzy Hash: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction Fuzzy Hash: 6AB092341502088F82409B59D449C00BBE8AF08A243454090E1088B632C621F8008A40

Function 074EADD0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84d0e26ec85f0b754c72f3f7d428e1bcaf28f3b9e645edd9d65db4901639f65
Instruction ID: fed3ca98785e47de38f1b1d9d7e6a0dac6e79874c230d28b88c4dae433de3dc6
Opcode Fuzzy Hash: f84d0e26ec85f0b754c72f3f7d428e1bcaf28f3b9e645edd9d65db4901639f65
Instruction Fuzzy Hash: 00B092320021488BD2023B60FC0E5083BB8BA043123C00060B18E804109A281C008A51

Function 074ED1F8 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7470a41baa7a743c262e162b353d6ae8b5a0a7a82f0d16667e92d6dc6b903126
Instruction ID: 265daa4d481df10faa9fda55c960d0a19dd16797652bd15ac14762823f294a8f
Opcode Fuzzy Hash: 7470a41baa7a743c262e162b353d6ae8b5a0a7a82f0d16667e92d6dc6b903126
Instruction Fuzzy Hash: 02B092304441088BC3402B68F80F1883F28EA8061378541A4E40A80011EFBF182CAA90

Function 074E85F0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction ID: 7de4840db72a739a7296ecabbd3d178890c8b70a70b6a7fce96b4b1d731f9c0f
Opcode Fuzzy Hash: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction Fuzzy Hash: 6AB092341502088F82409B59D449C00BBE8AF08A243454090E1088B632C621F8008A40

Function 074E05B0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258e5d32d5b08c31d9a4951c53ccd0e68d619f28ee8b9676012ad1b9555ff081
Instruction ID: 5110a67a5dbb6b82be70a35d5ac8f0af538b4b7f605035844e2ebe56396ac563
Opcode Fuzzy Hash: 258e5d32d5b08c31d9a4951c53ccd0e68d619f28ee8b9676012ad1b9555ff081
Instruction Fuzzy Hash: 29B09932002A08CFCA002FB8F80E088BB28AA00A023800020E88A800208F2AAC00CA82

Function 074EA830 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89140388685189994940f579d4be2cc4d2a48bcadc1b76560125b3d0cb9645c5
Instruction ID: dc960a4b288ad70092ff0e4b3f9edb42b0b64f9f0e607de20b425347f2055198
Opcode Fuzzy Hash: 89140388685189994940f579d4be2cc4d2a48bcadc1b76560125b3d0cb9645c5
Instruction Fuzzy Hash: F9B0923200010CFBCF016F81E80588DBF29FB14660B008011F948040208B329920AB91

Function 074EA8F0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36d8595de6cee9400947c61ed06ad6347dacc94be26bd4bd7869ddcb9cc36e4
Instruction ID: 2449a3c453af86c3675e90617e92351427971b9e93ad94f3b19b4bb7ef2f13a2
Opcode Fuzzy Hash: c36d8595de6cee9400947c61ed06ad6347dacc94be26bd4bd7869ddcb9cc36e4
Instruction Fuzzy Hash: 0DB092311602088F82409B68E444C0073A8AB08A243114090E1088B232C621F8008A40

Function 0715BF00 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa260706c740860bcb45d9350555ad80cb8779cb0a989f23b559f03cddcc3d0
Instruction ID: 2e4309b843882d66e842a8bc1958411bf851f414d42e76a287317b216b9134f6
Opcode Fuzzy Hash: 6aa260706c740860bcb45d9350555ad80cb8779cb0a989f23b559f03cddcc3d0
Instruction Fuzzy Hash: 91B092341606088F82009B58D448C04B3E8AB08A2430140D0E1088B232C621F8008A40

Function 0715E3F0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8862a4e9c5d1d7aafba6da6ede4dc05f3d7ed7052d51689dfb901227eb1b6423
Instruction ID: afd35e342da8057a1bb658c85d0a69ba10ad34f3064db065b4f7724dc471c596
Opcode Fuzzy Hash: 8862a4e9c5d1d7aafba6da6ede4dc05f3d7ed7052d51689dfb901227eb1b6423
Instruction Fuzzy Hash: 0DC09B754482C1DFCB0547E4A51B0D57F645D0210131941D7D549C55F3DA6C04758712

Function 0715F198 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154bd7be769be746f0884d874f57199d4bb885980737d639e9a64efbc4018222
Instruction ID: fe53257a03db1395a2fbbb4f552227f32b7ce5dda49c0c4ec89035f05d58884b
Opcode Fuzzy Hash: 154bd7be769be746f0884d874f57199d4bb885980737d639e9a64efbc4018222
Instruction Fuzzy Hash: 3CB01232224708878214674CF51746937ED938C6003004064B10E83B088E347C018948

Function 074E8270 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121612493c1ba6645b0f93439eaa6ba62d40716e1c9cd1eaa5c41cee4b689c6d
Instruction ID: cf918190263350f65a2786a720ea18fb1ff8f7f03a191440d578755a3cfa9213
Opcode Fuzzy Hash: 121612493c1ba6645b0f93439eaa6ba62d40716e1c9cd1eaa5c41cee4b689c6d
Instruction Fuzzy Hash: 8FA02230082B0C82C202B3FA2000820338C2A000083C008F8820C8EB300833E0A080C2

Function 074E85D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0affcfe4d7080cd3ab016e9a83b6fc750a5dfd864590e28615590239e39cf6
Instruction ID: e514e04fa6ddbc1c1adc1fd68cea98cce4de8e62792fba27bca475da461456ae
Opcode Fuzzy Hash: 5e0affcfe4d7080cd3ab016e9a83b6fc750a5dfd864590e28615590239e39cf6
Instruction Fuzzy Hash: FAA0123004120887C2005644E94A414F75C96445053108058900E021024F26BC11C581

Function 074E85B0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c121f769962aa70c87f8e4e7c9068aa56dad7f47d0b32e81ac352167503cea76
Instruction ID: 4d1bb31f37dd503126e8fff50777c8953f0719d8a8c2a415a377106212e9af49
Opcode Fuzzy Hash: c121f769962aa70c87f8e4e7c9068aa56dad7f47d0b32e81ac352167503cea76
Instruction Fuzzy Hash: A8A0243004370CCFC7001770710D114F75CD5001073500075F10C055114F37D430C541

Function 0715E11A Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daed8623eab886dcb8e4e558056cb04f98d5dcc214d36bae67ea3e5bb8d363b2
Instruction ID: 8c2cbcca55348ce24b89520f9241314dd5f8402e3c54ad002835369fa0f49a13
Opcode Fuzzy Hash: daed8623eab886dcb8e4e558056cb04f98d5dcc214d36bae67ea3e5bb8d363b2
Instruction Fuzzy Hash: 01B012302483C27DD781476020488D07FA2594D02536402DEF08DC0802873A40558301

Function 0715C1C0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137770e0a3859c2b89319aef5b6ab7bdf3a8e3516edd57b2df19af36a8191abc
Instruction ID: 5484b50a0ca20b13c13a720cbc9e7396148e9e539bdd59bbd3a8750b1cd6a9fe
Opcode Fuzzy Hash: 137770e0a3859c2b89319aef5b6ab7bdf3a8e3516edd57b2df19af36a8191abc
Instruction Fuzzy Hash: 38A02230003B0C82820832F8A00002033AC080000A3A000F8820C8CA30083BE8E2808A

Function 074E8A10 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ee1a02fda367d96b2ef8d0272b78c03c3fca93c28f516a31179643555b9977
Instruction ID: 7727ec05fb3096d04957693bb81ebd631527339751b2487a631cc9cd51501847
Opcode Fuzzy Hash: 63ee1a02fda367d96b2ef8d0272b78c03c3fca93c28f516a31179643555b9977
Instruction Fuzzy Hash: EC90023204564CCB89413799750A595775C9544536B810051B98D815015A6968544595

Function 07152E30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb76581a478225284fbe143dbc69db4fb43f12c6dee779808a16def2f2ac6a11
Instruction ID: ba726f15891a9f078ab012a40deeb244cc087d7e4e509e642726fab0ca70b0fb
Opcode Fuzzy Hash: cb76581a478225284fbe143dbc69db4fb43f12c6dee779808a16def2f2ac6a11
Instruction Fuzzy Hash: B190023504964CAB4640A7D5B40DA567B5DE5845267C50061E60D415019AAA79104595

Function 0715E120 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85f5b3dcfaac2357e96bc477c2178ab68e9f2a0b0cb34d8c58df62e6e8a24dc
Instruction ID: 692806927cfce94bf1f88a63cde06ef1abd850129574bb66f060317a72d8a7fb
Opcode Fuzzy Hash: d85f5b3dcfaac2357e96bc477c2178ab68e9f2a0b0cb34d8c58df62e6e8a24dc
Instruction Fuzzy Hash: E890023114460C8B85C02795740A9D577DD95845667C14151A50DC19515A6D64544596

Function 074E4618 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3926547108.00000000074E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_74e0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5526f6502109c52d3f7540d2b415b7a55e2d17e47f01fa9d2a165ef948a037c
Instruction ID: 150854007aecdbe2b5ec4f4236008992d7eea31398f043f654d1482c65eb0014
Opcode Fuzzy Hash: d5526f6502109c52d3f7540d2b415b7a55e2d17e47f01fa9d2a165ef948a037c
Instruction Fuzzy Hash: 51B01230209004C7D7004704C91DB583721E701201F00019194265319086385C048E00

Function 07158740 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3925445287.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccb3b4f77165bc1bbcec4cd210275d28a541dd9ea8476df34373e7d4b516815
Instruction ID: 7d8e2895bf38471f419d9e0907385f4be459361c8d789e4c1d9d2b13b942f29d
Opcode Fuzzy Hash: 7ccb3b4f77165bc1bbcec4cd210275d28a541dd9ea8476df34373e7d4b516815
Instruction Fuzzy Hash: 0FA002A0918614CEF7589A198406755B6E19705340F1144AA6C19D11C0D3344A40DF12

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\installer[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\installer[1].htm

C:\Users\user\AppData\Local\Temp\AdguardVPN\AdguardVPN_20240622004005.log

C:\Users\user\AppData\Local\Temp\adguard\setup.exe

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1028\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1029\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1030\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1031\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1032\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1035\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1036\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1038\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1040\mbapreq.wxl

C:\Windows\Temp\{07FE436D-5CEF-4CC5-B582-55A377168D7F}\.ba\1041\mbapreq.wxl

Windows Analysis Report
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre